org.cyclonedx/cyclonedx-core-java vulnerabilities

Latest org.cyclonedx/cyclonedx-core-java CVEs

Newest publication first

1. CVE-2025-64518 CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

   Published 2025-11-10

   High·CVSS 7.5 EPSS 0.39%

   The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML Validator used by cyclonedx-core-java was not configured securely, makin...

2. CVE-2024-38374 Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java

   Published 2024-06-28

   High·CVSS 7.5 EPSS 0.59%

   The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java leverages XPath expressions to determine the schema...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.