Eclipse Foundation jaxb-ri (core)
- CVE-2026-92877 The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block exte 0.3%