PULSE
ESEN
FEED
ransomendzone reclama a Momentum Telecom · Technologyransomendzone reclama a Absolute Bail Bonds · US · Financial Servicesransomeverest reclama a Grundbaulabor Trier GmbH · DE · Manufacturingransomnetrunner reclama a I****** A***** · KWransominterlock reclama a K&A Industries · USransomeverest reclama a Final Notice Before Publication · Otherransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomplay reclama a ARRB Group · AU · Government & Defenseransomincransom reclama a Advantage Archives · US · Professional Servicesransomincransom reclama a sportsmansguide.com · US · Retail & E-Commerceransomwallstreet reclama a Walgreen Co. · US · Retail & E-Commerceransomendzone reclama a Momentum Telecom · Technologyransomendzone reclama a Absolute Bail Bonds · US · Financial Servicesransomeverest reclama a Grundbaulabor Trier GmbH · DE · Manufacturingransomnetrunner reclama a I****** A***** · KWransominterlock reclama a K&A Industries · USransomeverest reclama a Final Notice Before Publication · Otherransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomplay reclama a ARRB Group · AU · Government & Defenseransomincransom reclama a Advantage Archives · US · Professional Servicesransomincransom reclama a sportsmansguide.com · US · Retail & E-Commerceransomwallstreet reclama a Walgreen Co. · US · Retail & E-Commerce
← Todos os CVEs
CVE Watch14 de out. de 2026

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML pars

CVSS

4.3

Sem CVSS

EPSS

7.6%

p95

KEV

—

Exploit Today

28

0-100

Publicado: 31 de mai. de 2014 · Última mod.: 14 de out. de 2026 · CWE-264

EPSS · 30d
7.6%EPSS · 30 dias7.6%
2026-10-172026-11-13
Descrição técnica

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

Referências oficiais
CVEs relacionados
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1011845.5 MÉD
0.1%
——0Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.12dCVE-2026-1011773.7 BAI
3.9%
——1Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.12dCVE-2026-1011767.1 ALT
2.9%
——1Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.12dCVE-2026-1011726.2 MÉD
0.5%
——0Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.12dCVE-2026-1011713.6 BAI
0.3%
——0Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect service integrity.12dCVE-2026-1163676.3 MÉD
22.3%
——7A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.12d