CVE-2026-112198

XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.

• CWE-611

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11219Inappropriate implementation in Navigation in Google Chrome …4.3
• CVE-2026-112190A security vulnerability has been detected in Webkul Aureus …5.3
• CVE-2026-112192MISP contains a vulnerability in the handling of module plug…5.3
• CVE-2026-112193A vulnerability was detected in Webkul Aureus ERP up to 1.6.…3.7
• CVE-2026-112195A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. …4.7
• CVE-2026-112197Vulnerability due to a lack of authentication in critical fu…9.4
• CVE-2026-112199Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-1122A vulnerability was determined in Yonyou KSOA 9.0. This impa…9.8
• CVE-2026-11220Insufficient validation of untrusted input in Navigation in …6.5
• CVE-2026-112200P-Net before 1.0.3 does not release the Application Relation…8.7
• CVE-2026-112202Imager::File::GIF versions before 1.006 for Perl allow out-o…6.5
• CVE-2026-112207The Download Monitor WordPress plugin before 5.3.4 does not …7.1