CVE-2026-120761

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

• CWE-611

• https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html
• https://github.com/apache/axis-axis2-java-core/commit/1d3457d12399c7721ed3f52e7031d1d24d169460
• https://lists.apache.org/thread.html/7jw9v3qz0cdpon7fc6vsvkqp0jdt5kt0
• https://www.openwall.com/lists/oss-security/2026/11/06/22

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120754HDF5 through 2.2.0 contains an uninitialized memory read vul…3.3
• CVE-2026-120755HDF5 through 2.2.0 contains an out-of-bounds read vulnerabil…5.5
• CVE-2026-120756HDF5 through 2.2.0 contains a heap buffer over-read vulnerab…6.1
• CVE-2026-120757HDF5 through 2.2.0 contains a heap buffer over-read vulnerab…7.1
• CVE-2026-120758HDF5 through 2.2.0 contains a NULL pointer dereference vulne…5.5
• CVE-2026-12076Raytha CMS is vulnerable to SQL Injection within the OData f…9.3
• CVE-2026-12077The Dokan Pro plugin for WordPress is vulnerable to time-bas…7.5
• CVE-2026-120775Tanium addressed a heap-based buffer overflow vulnerability …7.2
• CVE-2026-120778Creation of temporary file in directory with insecure permis…7.3
• CVE-2026-120779Improper control of generation of code ('code injection') in…9.6
• CVE-2026-120780Improper access control in Visual Studio Code allows an unau…8.3
• CVE-2026-120782Improper control of generation of code ('code injection') in…7.8