xxe vulnerabilities
xxe in numbers
sbomify tracks 1,711 xxe vulnerabilities. Most are found in server software (36%), web application (23%) and library (22%).
How to fix xxe vulnerabilities
Most exploited xxe vulnerabilities
- CVE-2024-34102 Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)
- CVE-2022-47966 Zoho ManageEngine Multiple Products Remote Code Execution
- CVE-2019-9670 Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
- CVE-2025-2775 SysAid On-Prem Improper Restriction of XML External Entity Reference
- CVE-2025-2776 SysAid On-Prem Improper Restriction of XML External Entity Reference
- CVE-2025-58360 OSGeo GeoServer Improper Restriction of XML External Entity Reference
- CVE-2020-1147 Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution
- CVE-2023-45727 North Grid Proself Improper Restriction of XML External Entity (XXE) Reference
- CVE-2019-13608 Citrix StoreFront Server XML External Entity (XXE) Processing
- CVE-2016-9563 SAP NetWeaver XML External Entity (XXE)
- CVE-2009-3960 Adobe BlazeDS Information Disclosure
- CVE-2022-22486 IBM Tivoli Workload Scheduler XML external entity injection
Recently published
- CVE-2026-104679 XML external entity in VOCALOID6 Editor
- CVE-2026-109430 Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
- CVE-2026-111252 OpenNMS denial of service via XML entity expansion
- CVE-2026-58395 OPNsense: XPath injection in MVC safe-delete
- CVE-2026-88794 XML External Entity injection in Sparx Enterprise Architect
- CVE-2026-102037 Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.