CVE-2026-19614

  • Cybersecurity
  • Cybersecurity services
  • Type Cyber Threat Research

Author: Dominique Righetto
Published: 09/09/2026

Abstract Advisory Information

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3.

Author: Dominique RIGHETTO

 

Version affected

Name:NanoXML

Versions: 2.2.3

 

Common Vulnerability Scoring System

5.3 

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

 

Patch

No patch available

 

References

https://www.cve.org/CVERecord?id=CVE-2026-19614
https://www.thalesgroup.com/en/search/cybersecurity/cybersecurity-services/cve-2026-19614 

 

Vulnerability Disclosure Timeline 

13/06/2026: Vulnerability discovery 

13/06/2026: Vulnerability Report to TCS-CERT 

12/08/2026: Vulnerability Report to Vendor through email : cyberelf@mac.com 

12/08/2026: Reserver CVE ID CVE-2026-19614 

08/09/2026: CVE-2026-19614 publish on CVE.org

09/09/2026: Expected Vulnerability disclosure