CVE-2026-76572

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.

• CWE-610
• CWE-611

• https://github.com/pkp/pkp-lib/
• https://github.com/pkp/pkp-lib/commit/78c699370ea43ae2784e1c4ace7c947d207f2b47
• https://github.com/pkp/pkp-lib/issues/12977
• https://github.com/pkp/pkp-lib/releases/tag/3_5_0-5
• https://vuldb.com/cve/CVE-2026-76572
• https://vuldb.com/submit/878359
• https://vuldb.com/vuln/393037
• https://vuldb.com/vuln/393037/cti

Published

Aug 19, 2026

Last Modified

Aug 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76562The Sidebar Manager Light plugin for WordPress is vulnerable…7.2
• CVE-2026-76564Joomla Extension - phoca.cz - Stored XSS via User-Agent hea…8.6
• CVE-2026-76565Joomla Extension - phoca.cz - Reflected XSS via price_from &…5.3
• CVE-2026-76569Joomla Extension - phoca.cz - Reflected XSS via the search G…5.3
• CVE-2026-7657IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow s…6.5
• CVE-2026-76571Joomla Extension - fabrikar.com - Unauthenticated SQL inject…9.3
• CVE-2026-76573The Pods – Custom Content Types and Fields plugin for WordPr…6.4
• CVE-2026-76574A flaw has been found in code-projects Hospital Information …7.3
• CVE-2026-76576A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3…4.3
• CVE-2026-76578A flaw was found in FreeIPA. The self-managed OTP token ACI …9.8
• CVE-2026-76579The LiteSpeed Cache plugin for WordPress is vulnerable to Re…4.7
• CVE-2026-7658IBM Langflow OSS 1.0.0 through 1.10.3 does not properly vali…6.5