https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T00:29:59.390571+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-375048 EUVD-2026-375048 2026-10-06T00:29:59.435948+00:00 EUVD-2026-375048 https://cve.radiocsirt.org/vuln/fkie_cve-2026-89260 fkie_cve-2026-89260 2026-10-06T00:29:59.435992+00:00

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

 https://cve.radiocsirt.org/vuln/ghsa-92wh-xp96-v6mj GHSA-92wh-xp96-v6mj 2026-10-06T00:29:59.436042+00:00

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.