InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product xmlsoft:libxml2. Show all products

49 CVEs, showing 1 to 49
CVESeverityTitlePublished
CVE-2026-86144Medium 5.6In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags.
Assigned by mitre
Sep 5, 2026
CVE-2026-86143Medium 6.9In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling…
Assigned by mitre
Sep 5, 2026
CVE-2026-86142Medium 6.9In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Assigned by mitre
Sep 5, 2026
CVE-2026-86141Low 2.9xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
Assigned by mitre
Sep 5, 2026
CVE-2026-86140High 8.0In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
Assigned by mitre
Sep 5, 2026
CVE-2026-86139Medium 6.9In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
Assigned by mitre
Sep 5, 2026
CVE-2026-86138Medium 6.9In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
Assigned by mitre
Sep 5, 2026
CVE-2026-86137Low 2.9In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
Assigned by mitre
Sep 5, 2026
CVE-2026-11979High 7.8libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode.Jun 29, 2026
CVE-2026-6653Critical 9.8Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper en…Jun 22, 2026
CVE-2026-6732High 7.5A flaw was found in libxml2.Apr 23, 2026
CVE-2026-0992Low 2.9A flaw was found in the libxml2 library.Jan 15, 2026
CVE-2026-0990Medium 5.9A flaw was found in libxml2, an XML parsing library.Jan 15, 2026
CVE-2026-0989Low 3.7A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled.Jan 15, 2026
CVE-2025-6170Low 2.5Libxml2: stack buffer overflow in xmllint interactive shell command handling
Assigned by redhat
Jun 16, 2025
CVE-2025-6021High 7.5Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2
Assigned by redhat
Jun 12, 2025
CVE-2024-34459High 7.5An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7.
Assigned by mitre
May 13, 2024
CVE-2024-25062High 7.5An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5.
Assigned by mitre
Feb 4, 2024
CVE-2023-45322Medium 6.5libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.
Assigned by mitre
Oct 6, 2023
CVE-2023-39615Medium 6.5Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c.
Assigned by mitre
Aug 29, 2023
CVE-2023-29469Medium 6.5An issue was discovered in libxml2 before 2.10.4.
Assigned by mitre
Apr 24, 2023
CVE-2023-28484Medium 6.5In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault.
Assigned by mitre
Apr 24, 2023
CVE-2022-40304High 7.8An issue was discovered in libxml2 before 2.10.3.
Assigned by mitre
Nov 23, 2022
CVE-2022-40303High 7.5An issue was discovered in libxml2 before 2.10.3.
Assigned by mitre
Nov 22, 2022
CVE-2016-3709Medium 6.1Possible cross-site scripting vulnerability in libxml after commit 960f0e2.
Assigned by redhat
Jul 28, 2022
CVE-2022-29824Medium 6.5In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows.
Assigned by mitre
May 3, 2022
CVE-2022-23308High 7.5valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
Assigned by mitre
Feb 26, 2022
CVE-2021-3541Medium 6.5A flaw was found in libxml2.
Assigned by redhat
Jul 9, 2021
CVE-2021-3517High 8.6There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.
Assigned by redhat
May 19, 2021
CVE-2021-3518High 8.8There's a flaw in libxml2 in versions before 2.9.11.
Assigned by redhat
May 18, 2021
CVE-2021-3537Medium 5.9A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference.
Assigned by redhat
May 14, 2021
CVE-2020-24977Medium 6.5GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
Assigned by mitre
Sep 3, 2020
CVE-2020-7595High 7.5xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
Assigned by mitre
Jan 21, 2020
CVE-2019-20388High 7.5xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
Assigned by mitre
Jan 21, 2020
CVE-2019-19956High 7.5xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
Assigned by mitre
Dec 24, 2019
CVE-2018-14567Medium 6.5libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a dif…
Assigned by mitre
Aug 16, 2018
CVE-2018-14404Medium 6.5A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
Assigned by mitre
Jul 19, 2018
CVE-2017-18258Medium 6.5The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not r…
Assigned by mitre
Apr 8, 2018
CVE-2017-7375Critical 9.8A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD…
Assigned by mitre
Feb 19, 2018
CVE-2017-7376Critical 9.8Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
Assigned by mitre
Feb 19, 2018
CVE-2017-16932High 7.5parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Assigned by mitre
Nov 23, 2017
CVE-2017-16931Critical 9.8parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.
Assigned by mitre
Nov 23, 2017
CVE-2017-9050High 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c.
Assigned by mitre
May 18, 2017
CVE-2017-9049High 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c.
Assigned by mitre
May 18, 2017
CVE-2017-9048High 7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow.
Assigned by mitre
May 18, 2017
CVE-2017-9047High 7.5A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801.
Assigned by mitre
May 18, 2017
CVE-2016-9318Medium 5.5libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened,…
Assigned by mitre
Nov 16, 2016
CVE-2016-4658Critical 9.8xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, wh…
Assigned by apple
Sep 25, 2016
CVE-2016-5131High 8.8Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via…
Assigned by Chrome
Jul 23, 2016

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.