CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 18/08/2026 |
| CVE-2026-56412 | 中危5.9 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. | 21/06/2026 |
| CVE-2026-56411 | 中危6.9 | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | 21/06/2026 |
| CVE-2026-56410 | 中危6.9 | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | 21/06/2026 |
| CVE-2026-56409 | 中危6.5 | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | 21/06/2026 |
| CVE-2026-56408 | 中危6.9 | libexpat before 2.8.2 has an integer overflow in copyString. | 21/06/2026 |
| CVE-2026-56407 | 中危6.9 | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | 21/06/2026 |
| CVE-2026-56406 | 中危6.9 | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | 21/06/2026 |
| CVE-2026-56405 | 中危6.9 | libexpat before 2.8.2 has an integer overflow in getAttributeId. | 21/06/2026 |
| CVE-2026-56404 | 中危6.9 | libexpat before 2.8.2 has an integer overflow in addBinding. | 21/06/2026 |
| CVE-2026-56403 | 中危6.9 | libexpat before 2.8.2 has an integer overflow in storeAtts. | 21/06/2026 |
| CVE-2026-56132 | 中危6.9 | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. | 19/06/2026 |
| CVE-2026-56131 | 中危4.9 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). | 19/06/2026 |
| CVE-2026-50219 | 中危5.9 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, | 04/06/2026 |
| CVE-2026-45186 | 高危7.5 | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | 10/05/2026 |
| CVE-2026-41080 | 低危2.9 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | 16/04/2026 |
| CVE-2026-32778 | 中危5.5 | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. | 16/03/2026 |
| CVE-2026-32777 | 中危5.5 | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. | 16/03/2026 |