{"items":[{"id":"CVE-2026-86144","published":"2026-09-05T04:34:43.972Z","updated":"2026-09-08T13:04:51.845Z","title":"In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example,…","severity":"MEDIUM","score":5.6,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-86143","published":"2026-09-05T04:31:21.187Z","updated":"2026-09-08T18:06:25.507Z","title":"In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a…","severity":"MEDIUM","score":6.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-86142","published":"2026-09-05T04:29:33.323Z","updated":"2026-09-14T13:50:49.902Z","title":"In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.","severity":"MEDIUM","score":6.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-86141","published":"2026-09-05T04:27:59.795Z","updated":"2026-09-09T19:15:52.468Z","title":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length…","severity":"LOW","score":2.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-86140","published":"2026-09-05T04:26:13.860Z","updated":"2026-09-08T18:06:15.447Z","title":"In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.","severity":"HIGH","score":8,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-86139","published":"2026-09-05T04:23:14.686Z","updated":"2026-09-08T13:04:24.068Z","title":"In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.","severity":"MEDIUM","score":6.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00166,"kevAdded":null},{"id":"CVE-2026-86138","published":"2026-09-05T04:21:53.127Z","updated":"2026-09-08T18:04:58.145Z","title":"In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.","severity":"MEDIUM","score":6.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00132,"kevAdded":null},{"id":"CVE-2026-86137","published":"2026-09-05T04:19:30.745Z","updated":"2026-09-14T13:50:50.073Z","title":"In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.","severity":"LOW","score":2.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-11979","published":"2026-06-29T13:21:42.697Z","updated":"2026-06-29T13:59:18.501Z","title":"Stack-Based Buffer Overflow in libxml2","severity":"LOW","score":1.8,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00148,"kevAdded":null},{"id":"CVE-2025-32415","published":"2025-04-17T00:00:00.000Z","updated":"2025-11-03T19:53:26.647Z","title":"In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted…","severity":"LOW","score":2.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2025-32414","published":"2025-04-08T00:00:00.000Z","updated":"2025-11-03T19:53:25.162Z","title":"In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return…","severity":"MEDIUM","score":5.6,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00384,"kevAdded":null},{"id":"CVE-2025-24855","published":"2025-03-14T00:00:00.000Z","updated":"2026-02-26T19:09:31.574Z","title":"numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is…","severity":"HIGH","score":7.8,"vendor":"xmlsoft","product":"libxslt","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2024-55549","published":"2025-03-14T00:00:00.000Z","updated":"2025-11-03T20:48:48.086Z","title":"xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.","severity":"HIGH","score":7.8,"vendor":"xmlsoft","product":"libxslt","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2025-27113","published":"2025-02-18T00:00:00.000Z","updated":"2025-11-03T21:13:22.434Z","title":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.","severity":"LOW","score":2.9,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.01053,"kevAdded":null},{"id":"CVE-2025-24928","published":"2025-02-18T00:00:00.000Z","updated":"2026-02-26T19:08:48.412Z","title":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur…","severity":"HIGH","score":7.8,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2024-56171","published":"2025-02-18T00:00:00.000Z","updated":"2025-11-03T20:49:05.224Z","title":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit…","severity":"HIGH","score":7.8,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.01178,"kevAdded":null},{"id":"CVE-2022-49043","published":"2025-01-26T00:00:00.000Z","updated":"2025-11-03T20:35:14.313Z","title":"xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.","severity":"HIGH","score":8.1,"vendor":"xmlsoft","product":"libxml2","kev":false,"epss":0.00265,"kevAdded":null}]}