HIGH 8.3 NVD

CVE-2026-112198

XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files us

XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-noviges

Published: 2026-10-28 · Source: NVD · Feed updated: 2026-10-28

This high severity vulnerability with a CVSS score of 8.3 was published on 2026-10-28 via NVD.

vulnfeed aggregates 14962 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.