CVE-2026-113582High· 7.5▾ TwilightUNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera.
This issue affects Apache Abdera: all versions.
Apache Abdera is retired and no longer supported, so we do not plan to release a version that fixes this issue. Users are recommended to migrate to a maintained alternative. Applications that cannot migrate should ensure that untrusted XML cannot reach the affected Abdera parser or JDBC adapter parsing paths. Actively maintained downstream products may still be impacted if they include an affected Abdera artifact.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
org.apache.abdera:abdera-parser <= *org.apache.abdera:abdera-jdbc <= *apache_abdera >= cb5a3646fc8b2a620dba5bdde3a6b7a3753b1be2 <= *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90885High· 7.5Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
CVE-2026-71569Medium· 4.8Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
CVE-2026-115942NoneApache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
CVE-2026-105042NoneApache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
CVE-2026-114230NoneApache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
CVE-2026-105031NoneApache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.