CVE-2026-19614: Cyberelf Nanoxml

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3.

Affected products

• Cyberelf Nanoxml: version 2.2.3 only

Published 2026-09-08. Last modified 2026-09-09.