https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T12:54:22.724813+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-260638 EUVD-2026-260638 2026-10-07T12:54:22.796134+00:00 EUVD-2026-260638 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64518 fkie_cve-2025-64518 2026-10-07T12:54:22.796173+00:00

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

 https://cve.radiocsirt.org/vuln/ghsa-6fhj-vr9j-g45r GHSA-6fhj-vr9j-g45r — CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection 2026-10-07T12:54:22.796208+00:00

Affected: Maven: org.cyclonedx:cyclonedx-core-java

### Impact

The XML [`Validator`](https://docs.oracle.com/javase/8/docs/api/javax/xml/validation/Validator.html) used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.

The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed *parsing* of XML BOMs, but not *validation*.

### Patches

The vulnerability has been fixed in cyclonedx-core-java version 11.0.1.

### Workarounds

If feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

### References

* The issue was introduced via https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9 * The issue was fixed via https://github.com/CycloneDX/cyclonedx-core-java/pull/737 * https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory

 https://cve.radiocsirt.org/vuln/rhsa-2025:22195 RHSA-2025:22195 — Red Hat Security Advisory: Red Hat build of Quarkus 3.20.4 release and security update 2026-10-07T12:54:22.796245+00:00

cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2707 WID-SEC-W-2025-2707 — Red Hat Enterprise Linux (Quarkus): Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-07T12:54:22.796263+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux (Quarkus) ausnutzen, um Informationen offenzulegen.