CVE-2026-19721

XXE in TÜBİTAK BİLGEM's İmzager

State: published CNA: TR-CERT CVSS 3.1 3.3 Low NVD: deferred

Description

Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking. This issue affects İmzager: from 2.10.5 before 2.10.7.

Affected products

Vendor	Product	Versions
TÜBİTAK BİLGEM Software Technologies Research Institute	İmzager	2.10.5 to <2.10.7

References

External links from the record. They lead to third-party sites.

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1456 government-resource

Dates

Reserved: 2026-08-13
Published: 2026-11-04
Updated: 2026-11-09

CVSS

3.3 Low

Version: 3.1
Source: CNA (TR-CERT)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.11% probability of exploitation activity in the next 30 days

Percentile: 1.285%
Score date: 2026-11-10
Model: v2026.06.15

Weakness

CWE-611 Improper restriction of XML external entity reference

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-09

3.3 Low CVSS 3.1 · Computer Emergency Response Team of the Republic of Turkey, secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

This CVE at nvd.nist.gov