CVE-2023-35815: Devexpress

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.

Affected products

• Devexpress Devexpress: before 21.2.12 (fixed in 21.2.12); version 22.1.8 only; version 22.2.4 only; version 22.2.5 only

Published 2025-04-28. Last modified 2026-06-17.