file-read 3 Local File Inclusion via Language Cookie Leads to Arbitrary File Read | Flagged Jun 4, 2026 XXE Injection – Arbitrary File Disclosure via XML Import | Holloway May 13, 2026 XML External Entity (XXE) via Deck Import Feature | Tanuki May 6, 2026