CWE-776

CVEs per yearBy the year they were published

1. 20208
2. 20201
3. 20201
4. 20202
5. 20218
6. 20211
7. 20229
8. 20229
9. 20246
10. 20248
11. 20254
12. 202635

Newest CVEs

• CVE-2026-119724

  Apache JClouds: XML External Entity (XXE) in provider-response parsing

  Apache Software Foundation · Apache JClouds

  Not scored
• CVE-2026-115506

  libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay

  libexpat · libexpat

  High8.7
• CVE-2026-108357

  PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

  PHPOffice · PhpSpreadsheet

  High8.8
• CVE-2026-108358

  PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

  PHPOffice · PhpSpreadsheet

  High8.8
• CVE-2026-108086

  Apache Cocoon: XEE could lead to SSRF and information disclosure

  Apache Software Foundation · Apache Cocoon

  High7.5
• CVE-2026-111252

  OpenNMS denial of service via XML entity expansion

  The OpenNMS Group · Meridian

  Medium6.5
• CVE-2026-74030

  Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion

  Wazuh · wazuh-agent

  Medium6.9
• CVE-2026-108039

  Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

  Apache Software Foundation · Apache CXF

  High7.5
• CVE-2026-92001

  Apache Sling XSS: Missing parser resource limits

  Apache Software Foundation · Apache Sling XSS

  Medium6.1
• CVE-2026-54077

  ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

  ArcadeData · arcadedb

  High7.1

Vendors it comes up for most

1. Apache Software Foundation6
2. IBM4
3. NaturalIntelligence3
4. ruby3
5. Cisco2
6. Microsoft2
7. PHPOffice2
8. Toshiba Tec Corporation2
9. docling-project2
10. symfony2