xxe

• CVE-2026-40998 - Spring WS XPath XXE via StreamSource and SAXSource 2026-06-15
• XML external entities (XXE) — parser defaults 2026-04-25