CVE-2026-90993

Not scored yetLast modified Nov 12, 2026

Description

XXE vulnerability in Apache XML Graphics Batik.

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-611

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-909944.0A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data()CVE-2026-909955.5A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable AuthenticationCVE-2026-909965.5A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security SCVE-2026-909977.4A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database CVE-2026-909999.8Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become codeCVE-2026-91007.1The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents inCVE-2026-910008.4Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: bCVE-2026-910019.9A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS CVE-2026-910025.3A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.pCVE-2026-910039.1A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI ServCVE-2026-910047.3A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the filCVE-2026-910056.3A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file pr
CVE-2026-90993: Unscored | Vulnix