CVE-2016-3674High· 7.5▾ TwilightMultiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 1.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
8.2%
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
jboss_middleware = 1debian_linux = 8.0fedora = 22fedora = 23xstream < 1.4.9Upgrade past the affected range:
xstream 1.4.9Connected by shared product, vendor, weakness, or advisory.
CVE-2023-4061Medium· 6.5A flaw was found in wildfly-core
CVE-2026-16108Medium· 4.3A flaw was found in the default-groups REST endpoint and realm representation of Keycloak
CVE-2023-6393Medium· 5.3A flaw was found in the Quarkus Cache Runtime
CVE-2011-4088High· 7.5ABRT might allow attackers to obtain sensitive information from crash reports.
CVE-2024-50312Medium· 5.3A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query
CVE-2026-17048Medium· 5.5A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients