Vendor
YaCy Search Server through 1.941 is vulnerable to XML external entity (XXE) injection, allowing attackers to exfiltrate local files into the searchable index.