Apache Roller 6.1.7 fixes 15 security issues, including XXE
The Apache Roller PMC published 15 advisories on November 11, 2026, with fixes in release 6.1.7.
Stories per day · 30 days
2 RSS
Relatedn-able7n-central7rmm6remote-code-execution5apache4broadworks3cisco3information-disclosure3kev3proof-of-concept3xml3zero-day3able2shell2apache-camel2openwave2telecom2zdi2apache-abdera1
24 stories, newest first · one card per story
Stories tagged #xxe
N-able takes hosted N-central offline after Able2Shell PoC release
A researcher published proof-of-concept code for 33 issues, including unauthenticated RCE; N-able reports scanning but no confirmed compromises.
N-able warns of scanning for critical N-central flaws after public PoC
Hotfix 2, build 2026.4.1.26, covers seven CVEs, including path-traversal remote code execution CVE-2026-125882.
N-able releases N-central 2026.4 HF2 for publicly disclosed zero-days
Defused saw internet probing of the flaws; Shadowserver counts about 148 exposed servers, down from 1,338.
CISA adds Cisco BroadWorks XXE flaw to KEV (CVE-2026-20320)
An unauthenticated remote attacker can read sensitive configuration; the federal remediation due date is November 24.
N-able ships N-central emergency fix after 33 exploits published
Hosted N-central was taken offline worldwide, and on-premises customers were told to shut servers down until 2026.4 HF2.
Apache Axis2/Java before 2.0.2 vulnerable to XML External Entity injection (CVE-2026-120761)
The XML External Entity (XXE) injection vulnerability in Apache Axis2/Java allows attackers to inject external entities when clients import WSDL/XSD documents via wsdl4j.
Apache JClouds affected by XML entity expansion vulnerability (CVE-2026-119724)
Apache JClouds all versions vulnerable to XML entity expansion but project retired with no fix planned.
MailEnable XXE flaw lets authenticated attackers read sensitive data
ZDI rates CVE-2026-114552 at CVSS 6.5; login is required and no fix or affected versions are named.
Apache Camel patches XXE, deserialization, and credential flaws
Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.
1
Apache Camel Saxon resolves external entities in bodies (CVE-2026-90885)
camel-saxon before 4.18.5 and before 4.22.2 parses Source bodies with Saxon defaults; CVSS is 7.5.
Apache Abdera XXE in Atom parsing (CVE-2026-113582)
All Apache Abdera versions are affected and unsupported; CVSS 4.0 is 8.7 with high confidentiality impact.
Apache Cocoon XEE flaw can enable SSRF and file disclosure
The retired project’s form processor is affected in every version, and the report names no fixed release.
ZDI-26-779: (0Day) Sparx Systems Enterprise Architect XSLT Debugger XML External Entity Processing Information Disclosure Vulnerability
Unpatched ZDI zero-day lets remote attackers leak data from Sparx Enterprise Architect via XXE with user interaction.
CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import
Apache Roller 6.1.5 lets weblog admins read local files via XXE in OPML imports.
CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser
Apache Roller 6.1.5 parses trackback responses with XXE enabled, exposing server files.
ZDI-26-718: Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability
ZDI detailed CVE-2026-20235, an authenticated XML external entity information disclosure flaw (CVSS 4.9) in Cisco Identity Services Engine.
Cisco Identity Services Engine Vulnerabilities
Cisco patched ISE and ISE-PIC flaws enabling REST API authentication bypass, remote code execution, SQL injection, and XXE attacks.
USN-8770-1: SimpleSAMLphp vulnerabilities
Ubuntu patches SimpleSAMLphp signature validation and XXE flaws enabling user impersonation, privilege escalation, and information disclosure.
CVE-2026-82583, CVE-2026-78224, CVE-2026-82578: NextGen Mirth Connect SQL injection and XXE
CISA advisory ICSMA-26-253-01 covers three NextGen Mirth Connect flaws, including SQL injection and XXE, with testing performed against version 4.5.2.
NextGen Healthcare Mirth Connect
CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.
2
Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb
Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.
Cisco Advance Notification for Publication of August 19, 2026, Security Advisories
Cisco PSIRT's advance notice previews August 19, 2026 advisories including Critical CVSS 10.0 hardening releases for Crosswork and Secure Workload.
Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability
Cisco patched an XXE flaw in BroadWorks' OCI XML parser letting unauthenticated remote attackers read sensitive files from the filesystem.