org.apache.xmlgraphics/fop-core vulnerabilities

Latest org.apache.xmlgraphics/fop-core CVEs

Newest publication first

1. CVE-2026-71395 Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loading

   Published 2026-11-11

   Unknown EPSS 0.36%

   unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

2. CVE-2026-126627 Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users

   Published 2026-11-11

   Unknown EPSS 0.21%

   Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

3. CVE-2024-28168 Apache XML Graphics FOP: XML External Entity (XXE) Processing

   Published 2024-10-09

   High·CVSS 7.5 EPSS 1.0%

   Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.