Product · CycloneDX

cyclonedx-core-java

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 7.5

CVE-2025-64518

CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not con…

CycloneDX cyclonedx-core-java dependency-track-bundled dependency-track Wolfi Maven

Nov 10, 2025
High 7.5

CVE-2024-38374

Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions …

CycloneDX cyclonedx-core-java dependency-track org.cyclonedx:cyclonedx-core-java Wolfi Maven

Jun 28, 2024