CVE-2026-71375

HighCVSS 7.4/10Last modified Sep 8, 2026

Description

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container.

This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-713769.8OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 befo CVE-2026-713779.8Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-0 CVE-2026-713784.6ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource CVE-2026-7137910.0The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.CVE-2026-71389.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin CVE-2026-713808.7Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to ca CVE-2026-713814.0Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could result in a Security CVE-2026-713827.8Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th CVE-2026-713837.3is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vuln CVE-2026-713849.6is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vuln CVE-2026-713858.4ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre CVE-2026-713868.8is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user.