https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T21:06:58.597272+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0756 certfr-2025-avi-0756 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-17T21:06:58.605555+00:00 certfr-2025-avi-0756 https://cve.radiocsirt.org/vuln/euvd-2026-53950 EUVD-2026-53950 2026-10-17T21:06:58.605599+00:00 EUVD-2026-53950 https://cve.radiocsirt.org/vuln/fkie_cve-2019-10782 fkie_cve-2019-10782 2026-10-17T21:06:58.605621+00:00

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.

 https://cve.radiocsirt.org/vuln/ghsa-763g-fqq7-48wg GHSA-763g-fqq7-48wg — XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled)) 2026-10-17T21:06:58.605658+00:00

Affected: Maven: com.puppycrawl.tools:checkstyle

Due to an incomplete fix for [CVE-2019-9658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9658), checkstyle was still vulnerable to XML External Entity (XXE) Processing.

### Impact

#### User: Build Maintainers

This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.

#### User: Static Analysis as a Service

If you operate a site/service that parses "untrusted" Checkstyle XML configuration files, you are vulnerable to this and should patch.

Note from the discoverer of the original CVE-2019-9658:

> While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it's a common pattern to run the static code analysis tool inside of a Docker container with the following flags: > ``` > --net=none \ > --privileged=false \ > --cap-drop=ALL > ``` > Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF. > \- [Jonathan Leitschuh](https://twitter.com/jlleitschuh)

### Patches _Has the problem been patched? What versions should users upgrade to?_

Patched, will be released with version 8.29 at 26 Jan 2020.

### Workarounds _Is there a way f…

 https://cve.radiocsirt.org/vuln/gsd-2019-10782 gsd-2019-10782 2026-10-17T21:06:58.605750+00:00 gsd-2019-10782 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-10782 UBUNTU-CVE-2019-10782 2026-10-17T21:06:58.605769+00:00

Affected: Ubuntu:16.04:LTS: checkstyle, Ubuntu:18.04:LTS: checkstyle

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.