CWE-776

CVEs per yearBy the year they were published

1. 20082
2. 20091
3. 20112
4. 20171
5. 20199
6. 202012
7. 20219
8. 202211
9. 20236
10. 20248
11. 20255
12. 202637

Newest CVEs

• CVE-2026-124078

  plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser

  TooTallNate · plist.js

  High8.7
• CVE-2026-119724

  Apache JClouds: XML External Entity (XXE) in provider-response parsing

  Apache Software Foundation · Apache JClouds

  High7.5
• CVE-2026-115506

  libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay

  libexpat · libexpat

  High8.7
• CVE-2026-108357

  PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

  PHPOffice · PhpSpreadsheet

  High8.8
• CVE-2026-108358

  PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

  PHPOffice · PhpSpreadsheet

  High8.8
• CVE-2026-108086

  Apache Cocoon: XEE could lead to SSRF and information disclosure

  Apache Software Foundation · Apache Cocoon

  High7.5
• CVE-2026-111252

  OpenNMS denial of service via XML entity expansion

  The OpenNMS Group · Meridian

  Medium6.5
• CVE-2026-74030

  Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion

  Wazuh · wazuh-agent

  Medium6.9
• CVE-2026-108039

  Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

  Apache Software Foundation · Apache CXF

  High7.5
• CVE-2026-92001

  Apache Sling XSS: Missing parser resource limits

  Apache Software Foundation · Apache Sling XSS

  Medium6.1

Vendors it comes up for most

1. Apache Software Foundation6
2. IBM4
3. NaturalIntelligence3
4. Ruby3
5. Cisco2
6. Microsoft2
7. PHPOffice2
8. Toshiba Tec Corporation2
9. docling-project2
10. symfony2