CVE-2026-19614CWE-611xxe

CVE-2026-19614

published September 8, 2026

CVSS
5.3
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled.

This issue affects NanoXML: 2.2.3.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00232 · 13.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-09-08T15:17Z
References (1)
https://www.thalesgroup.com/en/search/cybersecurity/cybersecurity-services/cve-2026-19614 · 64c5ae8f-7972-4697-86a0-7ada793ac795
EPSS history
Timeline
  • 10 SEP 03:16Z
    EPSS moved — → 0%
    epss
  • 08 SEP 10:28Z
    XML External Entity (XXE) Injection in CyberELF NanoXML
    cvelistv5