Xmlsoft vulnerabilities

Products

• Libxml2 115
• Libxslt 25
• Libxml 8
• Xmllint 2

Newest

• gnome libxml2 In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not... CVE-2026-86144 Fix available 5.6 MediumSeptember 5, 2026
• gnome libxml2 In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse... CVE-2026-86143 Fix available 6.9 MediumSeptember 5, 2026
• gnome libxml2 In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of... CVE-2026-86142 Fix available 6.9 MediumSeptember 5, 2026
• gnome libxml2 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a... CVE-2026-86141 Fix available 2.9 LowSeptember 5, 2026
• gnome libxml2 In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. CVE-2026-86140 Fix available 8.0 HighSeptember 5, 2026
• gnome libxml2 In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. CVE-2026-86139 Fix available 6.9 MediumSeptember 5, 2026
• gnome libxml2 In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap... CVE-2026-86138 Fix available 6.9 MediumSeptember 5, 2026
• gnome libxml2 In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds... CVE-2026-86137 Fix available 2.9 LowSeptember 5, 2026
• gnome libxml2 Stack-Based Buffer Overflow in libxml2 CVE-2026-11979 Fix availableDisputed 1.8 LowJune 29, 2026
• gnome libxml2 libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling CVE-2026-6653 Fix available 7.0 HighJune 22, 2026
• xmlsoft libxml2, ibm aix, vios +10 more +12 more Libxml2: libxml2: denial of service via crafted xsd-validated document CVE-2026-6732 Fix available 6.5 MediumApril 23, 2026
• xmlsoft libxml2, ibm aix, vios +10 more +12 more Libxml2: libxml2: denial of service via crafted xml catalogs CVE-2026-0992 Fix available 2.9 LowJanuary 15, 2026
• xmlsoft libxml2, ibm aix, vios +10 more +12 more Libxml2: unbounded relaxng include recursion leading to stack overflow CVE-2026-0989 Fix available 3.7 LowJanuary 15, 2026
• xmlsoft libxml2, ibm aix, vios +10 more +12 more Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing CVE-2026-0990 Fix available 5.9 MediumJanuary 15, 2026
• gnome libxml2, siemens ruggedcom rox mx5000, ruggedcom rox mx5000re +9 more +11 more Stack overflow in libxml2 CVE-2025-9714 Fix available 6.2 MediumSeptember 2, 2025
• gnome libxml2, ibm aix, vios +2 more +4 more libxml2 xmlcatalog xmlParseSGMLCatalog recursion CVE-2025-8732 Fix availableDisputed 4.8 MediumAugust 8, 2025
• gnome libxslt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 more Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes CVE-2025-7424 Fix available 7.5 HighJuly 10, 2025
• xmlsoft libxml2, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +33 more +35 more Libxml2: stack buffer overflow in xmllint interactive shell command handling CVE-2025-6170 Fix available 2.5 LowJune 16, 2025
• xmlsoft libxml2, red hat discovery 2, enterprise linux 10 +46 more +48 more Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 CVE-2025-6021 Fix available 7.5 HighJune 12, 2025
• gnome libxml2 In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has... CVE-2025-32415 Fix available 2.9 LowApril 17, 2025
• gnome libxml2 In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the... CVE-2025-32414 Fix available 5.6 MediumApril 8, 2025
• gnome libxslt numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an... CVE-2025-24855 Fix available 7.8 HighMarch 14, 2025
• gnome libxslt xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion... CVE-2024-55549 Fix available 7.8 HighMarch 14, 2025
• gnome libxml2 libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in... CVE-2025-27113 Fix available 2.9 LowFebruary 18, 2025
• gnome libxml2, netapp active iq unified manager, h300s firmware +8 more +10 more libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in... CVE-2025-24928 Fix available 7.8 HighFebruary 18, 2025
• gnome libxml2, netapp active iq unified manager, h300s firmware +8 more +10 more libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in... CVE-2024-56171 Fix available 7.8 HighFebruary 18, 2025
• gnome libxml2 xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. CVE-2022-49043 Fix available 8.1 HighJanuary 26, 2025
• gnome libxml2, netapp h300s firmware, h410c firmware +6 more +8 more In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can... CVE-2024-40896 Fix available 9.1 CriticalAugust 2, 2024
• xmlsoft libxml2, xmllint, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7.... CVE-2024-34459 Fix available 7.5 HighMay 13, 2024
• xmlsoft libxml2, siemens simatic s7-1500 tm mfp - gnu/linux subsystem, sinec nms +2 more An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML... CVE-2024-25062 Fix available 7.5 HighFebruary 4, 2024
• xmlsoft libxml2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more ** DISPUTED ** libxml2 through 2.11.5 has a use-after-free that can only occur after a certain... CVE-2023-45322 Fix availableDisputed 6.5 MediumOctober 6, 2023
• xmlsoft libxml2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 more Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the... CVE-2023-39615 Fix availableDisputed 6.5 MediumAugust 29, 2023
• xmlsoft libxml2, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted... CVE-2023-29469 Fix available 6.5 MediumApril 12, 2023
• xmlsoft libxml2, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer... CVE-2023-28484 Fix available 6.5 MediumApril 12, 2023
• xmlsoft libxml2, apple ipados, iphone os +17 more +19 more An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can... CVE-2022-40304 Fix available 7.8 HighOctober 21, 2022
• xmlsoft libxml2, apple ipados, iphone os +17 more +19 more An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with... CVE-2022-40303 Fix available EPSS 41.4% 7.5 HighOctober 21, 2022
• gnome libxml2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more Possible cross-site scripting vulnerability in libxml after commit 960f0e2. CVE-2016-3709 Fix available 6.1 MediumJuly 28, 2022
• xmlsoft libxml2, libxslt, debian linux +19 more +21 more In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c ... CVE-2022-29824 Fix available 6.5 MediumMay 3, 2022
• xmlsoft libxml2, apple ipados, iphone os +36 more +38 more valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. CVE-2022-23308 Fix available 7.5 HighFebruary 26, 2022
• google chrome, xmlsoft libxslt, debian linux +1 more +3 more Nokogiri has vulnerable dependencies on libxml2 and libxslt CVE-2021-30560 Fix available EPSS 20.4% 8.8 HighJuly 21, 2021
• gnome libxml2, netapp active iq unified manager, cloud backup +19 more +21 more A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all... CVE-2021-3541 Fix available 6.5 MediumMay 18, 2021
• gnome libxml2, debian linux, fedoraproject fedora +19 more +21 more Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing CVE-2021-3537 Fix available 5.9 MediumMay 10, 2021
• gnome libxml2, debian linux, fedoraproject fedora +18 more +20 more Nokogiri Implements libxml2 version vulnerable to use-after-free CVE-2021-3518 Fix available EPSS 21.9% 8.8 HighMay 5, 2021
• gnome libxml2, debian linux, fedoraproject fedora +28 more +30 more Nokogiri contains libxml Out-of-bounds Write vulnerability CVE-2021-3517 Fix available EPSS 17.0% 8.6 HighMay 5, 2021
• gnome libxml2, xmlsoft xmllint, debian linux +10 more +12 more There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit... CVE-2021-3516 Fix available 7.8 HighMay 5, 2021
• xmlsoft libxml2, debian linux, fedoraproject fedora +18 more +20 more GNOME project libxml2 v2.9.10 and earlier have a global Buffer Overflow vulnerability in... CVE-2020-24977 Fix available 6.5 MediumSeptember 3, 2020
• xmlsoft libxml2, canonical ubuntu linux, debian linux +24 more +26 more libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation CVE-2020-7595 Fix available 7.5 HighJanuary 21, 2020
• xmlsoft libxml2, debian linux, fedoraproject fedora +24 more +26 more xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. CVE-2019-20388 Fix available 7.5 HighJanuary 21, 2020
• xmlsoft libxml2, canonical ubuntu linux, debian linux +12 more +14 more xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related... CVE-2019-19956 Fix available 7.5 HighDecember 24, 2019
• xmlsoft libxslt, canonical ubuntu linux, debian linux +2 more Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability CVE-2019-18197 Fix available 7.5 HighOctober 18, 2019
• Show olderLoading…