Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.115 | 6,0 % |
| <10 % | 343.293 | 92,9 % |
CVE-2026-93616 and the Risk of Exposing Check Point Management Interfaces
CVE-2026-93616 and the Risk of Exposing Check Point Management Interfaces Vulnerability overview CVE-2026-93616 is a path traversal vulnerability (CWE-22) in Check Point management and logging products, rated 9.8 (Critical) under CVSS v3. C
CVE-2026-109626 | Frappe ERPNext up to 16.34.1 sql injection (EUVD-2026-98017)
A vulnerability was found in Frappe ERPNext up to 16.34.1. It has been declared as critical. The affected element is an unknown function. Executing a manipulation can lead to sql injection. This vulnerability is handled as CVE-2026-109626.
CVE-2026-108116 | Progress Kendo UI for jQuery up to 2026.3.1014 PivotGrid XMLA transport injection (EUVD-2026-102080)
A vulnerability labeled as problematic has been found in Progress Kendo UI for jQuery up to 2026.3.1014. This vulnerability affects unknown code of the component PivotGrid XMLA transport. The manipulation results in injection. This vulnerab
CVE-2026-79824 | HPE NonStop Python path traversal (EUVD-2026-101969)
A vulnerability marked as very critical has been reported in HPE NonStop Python. This affects an unknown function. This manipulation causes path traversal. This vulnerability is handled as CVE-2026-79824. The attack can only be done within
CVE-2026-102980 | makeplane Plane up to 1.3.x Page Version Endpoint version.py PageVersionEndpoint permission (EUVD-2026-101617)
A vulnerability was found in makeplane Plane up to 1.3.x and classified as problematic. Affected by this vulnerability is the function PageVersionEndpoint of the file apps/api/plane/app/views/page/version.py of the component Page Version En
CVE-2026-109631 | Frappe ERPNext up to 15.119.0/16.31.x sql injection (EUVD-2026-98022)
A vulnerability marked as critical has been reported in Frappe ERPNext up to 15.119.0/16.31.x. This vulnerability affects unknown code. The manipulation leads to sql injection. This vulnerability is referenced as CVE-2026-109631. Remote exp
CVE-2026-55381 | InvoiceShelf up to 2.3.9 ConvertEstimateController improper authorization (EUVD-2026-101611)
A vulnerability was found in InvoiceShelf up to 2.3.9. It has been rated as critical. This vulnerability affects unknown code of the component ConvertEstimateController. Performing a manipulation results in improper authorization. This vuln
CVE-2026-54703 | shd101wyy vscode-markdown-preview-enhanced up to 0.8.29 Markdown Preview head.html _crossnote.updateMarkdown cross site scripting (EUVD-2026-101583)
A vulnerability was found in shd101wyy vscode-markdown-preview-enhanced up to 0.8.29. It has been rated as problematic. This affects the function _crossnote.updateMarkdown of the file head.html of the component Markdown Preview. The manipul
CVE-2025-23390 | SUSE Fleet up to 0.10.11/0.11.6/0.12.1 certificate validation (EUVD-2025-211104)
A vulnerability categorized as problematic has been discovered in SUSE Fleet up to 0.10.11/0.11.6/0.12.1. Affected is an unknown function. The manipulation results in improper certificate validation. This vulnerability is known as CVE-2025-
CVE-2024-22031 | Rancher Project authorization (EUVD-2024-55800)
A vulnerability was found in Rancher. It has been rated as problematic. This impacts an unknown function of the component Project Handler. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2024-22031. Th
Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can use it to write arbitrary files and run commands
Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface. Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary co
CVE-2019-8457 | Oracle MySQL Cluster up to 7.3.27/7.4.25/7.5.15/7.6.12 out-of-bounds (Nessus ID 236583 / ID 197482)
A vulnerability was found in Oracle MySQL Cluster up to 7.3.27/7.4.25/7.5.15/7.6.12 and classified as problematic. This issue affects some unknown processing. Such manipulation leads to out-of-bounds read. This vulnerability is uniquely ide
CVE-2019-5435 | libcURL up to 7.64.1 URL API integer overflow (K08125515 / ID 197472)
A vulnerability was found in libcURL up to 7.64.1. It has been declared as critical. This vulnerability affects unknown code of the component URL API. The manipulation results in integer overflow. This vulnerability is identified as CVE-201
CVE-2019-5018 | SQLite 3.26.0/3.27.0 SQL Command src/select.c sqlite3SelectPrep use after free (TALOS-2019-0777 / Nessus ID 236583)
A vulnerability described as critical has been identified in SQLite 3.26.0/3.27.0. The affected element is the function sqlite3SelectPrep of the file src/select.c of the component SQL Command Handler. The manipulation results in use after f
CVE-2019-3861 | Libssh2 up to 1.8.0 SSH Server Packet out-of-bounds (RHSA-2019:2136 / ID 172157)
A vulnerability labeled as critical has been found in Libssh2 up to 1.8.0. This vulnerability affects unknown code of the component SSH Server. Such manipulation as part of Packet leads to out-of-bounds read. This vulnerability is uniquely
CVE-2019-3860 | Libssh2 up to 1.8.0 SSH Server SFTP Packet out-of-bounds (DLA 1730-1 / Nessus ID 214139)
A vulnerability identified as critical has been detected in Libssh2 up to 1.8.0. This affects an unknown part of the component SSH Server. This manipulation as part of SFTP Packet causes out-of-bounds read. This vulnerability is handled as
CVE-2019-3857 | Libssh2 up to 1.8.0 SSH Server integer overflow (RHSA-2019:0679 / ID 172157)
A vulnerability categorized as critical has been discovered in Libssh2 up to 1.8.0. Affected by this issue is some unknown functionality of the component SSH Server. The manipulation results in integer overflow. This vulnerability is known
CVE-2019-3856 | Libssh2 up to 1.8.0 SSH Server integer overflow (RHSA-2019:0679 / ID 172157)
A vulnerability was found in Libssh2 up to 1.8.0. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component SSH Server. The manipulation leads to integer overflow. This vulnerability is trade
CVE-2018-12886 | GNU gcc up to 8 ARM cfgexpand.c stack_protect_prologue memory corruption
A vulnerability, which was classified as critical, was found in GNU gcc up to 8. This issue affects the function stack_protect_prologue of the file cfgexpand.c of the component ARM Handler. Such manipulation leads to memory corruption. This
Resumen de las Actualizaciones de Seguridad de Octubre de 2026 - Español
YouTube VideoNuestro mini-briefing de octubre presenta una visión general de la publicación de actualizaciones de seguridad de Microsoft y el análisis de algunos de los puntos más relevantes del mes. 00:00 - Introducción 00:35 - Resumen de
CVE-2019-9937 | SQLite 3.27.2 fts5 Virtual Table sqlite3.c fts5ChunkIterate null pointer dereference (USN-4019-1 / ID 172380)
A vulnerability was found in SQLite 3.27.2. It has been rated as critical. This issue affects the function fts5ChunkIterate of the file sqlite3.c of the component fts5 Virtual Table Handler. The manipulation leads to null pointer dereferenc
CVE-2019-9936 | SQLite 3.27.2 fts5 Prefix Query sqlite3.c fts5HashEntrySort out-of-bounds (ID 172380 / BID-98468)
A vulnerability was found in SQLite 3.27.2. It has been declared as critical. This vulnerability affects the function fts5HashEntrySort of the file sqlite3.c of the component fts5 Prefix Query Handler. Executing a manipulation can lead to o
CVE-2019-9923 | GNU tar up to 1.31 sparse.c pax_decode_header null pointer dereference (ID 172328 / BID-106354)
A vulnerability, which was classified as problematic, was found in GNU tar up to 1.31. Affected is the function pax_decode_header of the file sparse.c. The manipulation results in null pointer dereference. This vulnerability is known as CVE
CVE-2019-9169 | GNU C Library up to 2.29 Regular Expression posix/regexec.c proceed_next_node out-of-bounds (K54823184 / ID 13476)
A vulnerability categorized as critical has been discovered in GNU C Library up to 2.29. This affects the function proceed_next_node of the file posix/regexec.c of the component Regular Expression Handler. Such manipulation leads to out-of-
CVE-2019-3862 | Oracle Communications User Data Repository 12.4.0 Platform out-of-bounds (ID 176853 / BID-107485)
A vulnerability described as very critical has been identified in Oracle Communications User Data Repository 12.4.0. The affected element is an unknown function of the component Platform. Executing a manipulation can lead to out-of-bounds r
CVE-2019-3859 | Libssh2 up to 1.8.0 _libssh2_packet_require/_libssh2_packet_requirev Packet out-of-bounds (Bug 152136 / EUVD-2019-13473)
A vulnerability classified as critical was found in Libssh2 up to 1.8.0. This vulnerability affects the function _libssh2_packet_require/_libssh2_packet_requirev. Executing a manipulation as part of Packet can lead to out-of-bounds read. Th
CVE-2019-3858 | Libssh2 up to 1.8.0 SSH Server SFTP Packet out-of-bounds (RHSA-2019:2136 / ID 172157)
A vulnerability classified as critical was found in Libssh2 up to 1.8.0. Impacted is an unknown function of the component SSH Server. Such manipulation as part of SFTP Packet leads to out-of-bounds read. This vulnerability is traded as CVE-
CVE-2019-3855 | Apple Xcode up to 10.2 IDE SCM integer overflow (HT210609 / EUVD-2019-13469)
A vulnerability was found in Apple Xcode up to 10.2. It has been classified as critical. The affected element is an unknown function of the component IDE SCM. This manipulation causes integer overflow. This vulnerability is tracked as CVE-2
CVE-2022-46598 | TRENDnet TEW755AP 1.13B01 set_sta_enrollee_pin_5g wps_sta_enrollee_pin command injection (EUVD-2022-49402)
A vulnerability was found in TRENDnet TEW755AP 1.13B01. It has been declared as critical. Affected by this vulnerability is the function set_sta_enrollee_pin_5g. Such manipulation of the argument wps_sta_enrollee_pin leads to command inject
CVE-2022-46597 | TRENDnet TEW755AP 1.13B01 setup_wizard_mydlink sys_service command injection (EUVD-2022-49401)
A vulnerability was found in TRENDnet TEW755AP 1.13B01. It has been classified as critical. Affected is the function setup_wizard_mydlink. This manipulation of the argument sys_service causes command injection. This vulnerability is tracked
CVE-2022-46596 | TRENDnet TEW755AP 1.13B01 icp_delete_img del_num stack-based overflow (EUVD-2022-49400)
A vulnerability was found in TRENDnet TEW755AP 1.13B01 and classified as critical. This impacts the function icp_delete_img. The manipulation of the argument del_num results in stack-based buffer overflow. This vulnerability is identified a
CVE-2026-100803 | Mozilla Firefox up to 115.41/140.16/153.3/156 WebExtensions cross-domain policy (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability classified as problematic has been found in Mozilla Firefox up to 115.41/140.16/153.3/156. This affects an unknown function of the component WebExtensions. Performing a manipulation results in permissive cross-domain policy
CVE-2026-100789 | Mozilla Firefox up to 115.41/140.16/153.3/156 Canvas2D use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 115.41/140.16/153.3/156. Affected by this issue is some unknown functionality of the component Canvas2D. Performing a manipulation results in use after free.
CVE-2026-100811 | Mozilla Firefox up to 140.16/153.3/156 DOM Core/HTML use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability was found in Mozilla Firefox up to 140.16/153.3/156. It has been declared as critical. This issue affects some unknown processing of the component DOM Core/HTML Component. Executing a manipulation can lead to use after free.
CVE-2026-100781 | Mozilla Firefox up to 115.41/140.16/153.3/156 WebRender privileges management (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability categorized as critical has been discovered in Mozilla Firefox up to 115.41/140.16/153.3/156. This affects an unknown function of the component WebRender. The manipulation results in improper privilege management. This vulne
CVE-2026-100782 | Mozilla Firefox up to 115.41/140.16/153.3/156 Graphics privileges management (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability identified as critical has been detected in Mozilla Firefox up to 115.41/140.16/153.3/156. This impacts an unknown function of the component Graphics. This manipulation causes improper privilege management. This vulnerabilit
CVE-2026-100791 | Mozilla Firefox up to 115.41/140.16/153.3/156 DOM use after free (Nessus ID 366012 / WID-SEC-2026-3654)
A vulnerability marked as critical has been reported in Mozilla Firefox up to 115.41/140.16/153.3/156. This vulnerability affects unknown code of the component DOM. The manipulation leads to use after free. This vulnerability is traded as C
Thermo Fisher Torrent Suite Software
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software &
Guangzhou Juan IoT Technology EseeCloud
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App &lt;=4.9.
CVE-2026-104024 | Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary command, with no confirmation dialog. The prompt (Do you want to run this file?) is gated by SECEXTCONST, a hard-coded list of seven extensions (exe cmd msi b
Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an e
CVE-2026-106147 | In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the a
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can s
CVE-2026-106161 | In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. Successful exploitation can compromise the confidentiality and integrity of
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can mod
CVE-2026-106160 | In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the applicat
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data a
CVE-2026-106159 | In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler, and execute JavaScript in a user's browser when the affected button is interacted with. Successful exp
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL
CVE-2026-106158 | In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a res
CVE-2026-106157 | In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentialit
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can contro
CVE-2026-106162 | In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confiden
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are enco
CVE-2026-106163 | In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-contr
CVE-2026-110927 | A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connect
CVE-2026-110924 | A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state.
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection i
CVE-2026-109686 | Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-109892 | Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.29.13.
CVE-2026-109702 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.
CVE-2026-109688 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-109685 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.
CVE-2026-107416 | Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.
CVE-2026-105882 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-102389 | Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.
CVE-2026-88794 | Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allo