CVE-2026-90993CWE-611

CVE-2026-90993: vulnerability in Apache XML Graphics Batik

Apache XML Graphics Batik: Harden validation in SAXDocumentFactory

Published

Follow this CVE+ Monitor Apache XML Graphics Batik

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

0Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Track
XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Affected products
Apache Software Foundation · Apache XML Graphics Batik
Related CVEs — Apache XML Graphics Batik

In the same product, most dangerous first.

CVE-2022-44729—Apache XML Graphics Batik: Information disclosure vulnerabilityEPSS 0.9%CVE-2022-44730—Apache XML Graphics Batik: Information disclosure vulnerabilityEPSS 0.8%CVE-2026-89326—Apache XML Graphics Batik: Check url protocol when loading documentEPSS —CVE-2026-44929—SSRF Vulnerability in Apache BatikEPSS —CVE-2026-49236—Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checksEPSS —CVE-2026-40853—Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFontEPSS —