cyclonedx-core-java vulnerabilities

2 known vulnerabilities in cyclonedx-core-java from CycloneDX. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  cyclonedx-core-java: Improper Restriction of XML External Entity Reference

  CVE-2025-64518Nov 10, 2025CycloneDX

  The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not conf

• 7.5 High severity

  cyclonedx-core-java: Improper Restriction of XML External Entity Reference

  CVE-2024-38374Jun 28, 2024CycloneDX

  The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions t