https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T02:27:29.715984+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-54967 EUVD-2026-54967 2026-10-15T02:27:29.719117+00:00 EUVD-2026-54967 https://cve.radiocsirt.org/vuln/fkie_cve-2019-12331 fkie_cve-2019-12331 2026-10-15T02:27:29.719146+00:00

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ‚<!ENTITY‘ and thus allowing for an xml external entity processing (XXE) attack.

 https://cve.radiocsirt.org/vuln/ghsa-vvwv-h69m-wg6f GHSA-vvwv-h69m-wg6f — XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue 2026-10-15T02:27:29.719191+00:00

Affected: Packagist: phpoffice/phpspreadsheet, Packagist: phpoffice/phpexcel

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.

 https://cve.radiocsirt.org/vuln/gsd-2019-12331 gsd-2019-12331 2026-10-15T02:27:29.719222+00:00 gsd-2019-12331