CVE-2026-12975
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure process
CVSS
8.5
Alto
EPSS
0.2%
p14
KEV
—
Exploit Today
4
0-100
Publicado: 25 jun 2026 · Última mod.: 15 jul 2026 · CWE-611
0.2%EPSS · 30 días0.2%
2026-06-302026-07-18
A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via external DTD/entity fetch, or cause denial of service via entity expansion.
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-12975
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2491688
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-12975
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2491688
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12975.json
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-684938.1 ALT97.5%
——29Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.4dCVE-2026-261717.5 ALT75.4%
——23Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.4dCVE-2020-259129.1 CRÍ68.1%
——20A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).10dCVE-2023-269999.8 CRÍ60.6%
——18An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file.10dCVE-2021-450249.8 CRÍ59.5%
——18ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (XXE).10dCVE-2023-241877.8 ALT56.2%
——17An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.10d