CVE-2023-46035Medium· 5.9▾ SunlitThe svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 5.9
none → medium
0.4%
Last analysed / modified upstream
The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19248High· 7.1QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.
CVE-2026-11573High· 7.1Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase)
CVE-2026-58234Low· 2.2SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system r…
CVE-2026-33818High· 7.5Enforce maximum recursion depth in encoding/asn1
CVE-2026-54077High· 7.1ArcadeDB is a Multi-Model DBMS
CVE-2026-26278High· 7.5fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback