xml 3 XXE Injection via Envelope Import Leads to Arbitrary File Read | Foldmark Jun 9, 2026 XInclude Injection to Arbitrary File Read | Tanuki May 12, 2026 XML External Entity (XXE) via Deck Import Feature | Tanuki May 6, 2026