CVE-2026-101893
🔶 mediumSummary
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed network share can perform SSRF, capture NTLMv2 credentials, read local files, or crash the process. Fixed in 1.6.0.
CVSS Score
4.4
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-10-05
First Seen: 2026-10-08
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 11.4% of all 365,616 vulnerabilities in our database.
#324,074
Below average severity
Severity Percentile
Last Modified
2026-10-06
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS Vector 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)