CVE-2023-46035Medium· 5.9▾ SunlitThe svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 5.9
none → medium
0.4%
Last analysed / modified upstream
0.4% → 0.4%
The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115506High· 7.5libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
CVE-2026-108357High· 8.8PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
CVE-2026-108358High· 8.8PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
CVE-2026-108086NoneApache Cocoon: XEE could lead to SSRF and information disclosure
CVE-2026-111252Medium· 6.5A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon
CVE-2024-28757High· 7.5libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).