Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2022-25236exploit | 9.8 critical | 35.0% | libexpat_project, debian, libexpat, debian_linux, http_server | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | 14 Oct |
| CVE-2022-25315exploit | 9.8 critical | 5.0% | libexpat_project, debian, libexpat, debian_linux, fedora | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 14 Oct |
| CVE-2022-25235exploit | 9.8 critical | 5.0% | libexpat_project, debian, libexpat, debian_linux, fedora | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. | 14 Oct |
| CVE-2022-23852exploit | 9.8 critical | 5.0% | libexpat_project, netapp, libexpat, clustered_data_ontap, oncommand_workflow_automation | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. | 14 Oct |
| CVE-2022-22822exploit | 9.8 critical | 5.0% | libexpat_project, tenable, libexpat, nessus, sinema_remote_connect_server | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 14 Oct |
| CVE-2021-45960exploit ×2 | 8.8 high | 5.0% | libexpat_project, tenable, libexpat, nessus, debian_linux | In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). | 14 Oct |
| CVE-2022-25314exploit | 7.5 high | 5.0% | libexpat_project, debian, libexpat, debian_linux, fedora | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | 14 Oct |
| CVE-2022-23990exploit | 7.5 high | 5.0% | libexpat_project, tenable, libexpat, nessus, communications_metasolv_solution | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. | 14 Oct |
| CVE-2021-46143exploit | 7.8 high | 4.0% | libexpat_project, netapp, libexpat, active_iq_unified_manager, clustered_data_ontap | In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. | 14 Oct |
| CVE-2022-43680exploit ×2 | 7.5 high | 3.0% | libexpat_project, debian, libexpat, debian_linux, fedora | In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. | 14 Oct |
| CVE-2022-25313exploit ×2 | 6.5 medium | 3.0% | libexpat_project, debian, libexpat, debian_linux, fedora | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | 14 Oct |
| CVE-2024-28757exploit ×2 | 7.5 high | 2.0% | libexpat_project, fedoraproject, libexpat, fedora, active_iq_unified_manager | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). | 15 Oct |
| CVE-2024-50602exploit | 5.9 medium | 1.0% | netapp, debian, active_iq_unified_manager, solidfire_\&_hci_management_node, solidfire_\&_hci_storage_node | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. | 15 Oct |
| CVE-2013-0340 | 6.8 medium | 19.0% | libexpat_project, python, libexpat, ipados | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. | 14 Oct |
| CVE-2016-0718 | 9.8 critical | 13.0% | mozilla, apple, firefox, mac_os_x, linux_enterprise_debuginfo | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. | 8 Oct |
| CVE-2016-4472 | 8.1 high | 12.0% | libexpat_project, canonical, libexpat, ubuntu_linux, policy_auditor | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716. | 8 Oct |
| CVE-2017-9233 | 7.5 high | 9.0% | libexpat_project, python, libexpat, debian_linux | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. | 8 Oct |
| CVE-2019-15903 | 7.5 high | 7.0% | libexpat_project, python, libexpat | In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. | 14 Oct |
| CVE-2018-20843 | 7.5 high | 7.0% | libexpat_project, canonical, libexpat, ubuntu_linux, debian_linux | In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks). | 14 Oct |
| CVE-2022-22824 | 9.8 critical | 4.0% | libexpat_project, tenable, libexpat, nessus, debian_linux | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 14 Oct |
| CVE-2022-22823 | 9.8 critical | 4.0% | libexpat_project, tenable, libexpat, nessus, debian_linux | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 14 Oct |
| CVE-2022-22827 | 8.8 high | 3.0% | libexpat_project, tenable, libexpat, nessus, debian_linux | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 14 Oct |
| CVE-2022-22826 | 8.8 high | 3.0% | libexpat_project, tenable, libexpat, nessus, debian_linux | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 14 Oct |
| CVE-2022-22825 | 8.8 high | 3.0% | libexpat_project, tenable, libexpat, nessus, debian_linux | lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 14 Oct |
| CVE-2022-40674 | 8.1 high | 2.0% | libexpat_project, debian, libexpat, debian_linux, fedora | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. | 14 Oct |
| CVE-2023-52425 | 7.5 high | 2.0% | libexpat_project, libexpat | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | 15 Oct |
| CVE-2026-66046 | 8.7 high | 1.0% | libexpat_project, libexpat | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. | Thu 22 Oct |
| CVE-2025-59375 | 7.5 high | 1.0% | libexpat_project, libexpat | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. | 19 Oct |
| CVE-2026-56132 | 6.9 medium | 0.00% | libexpat_project, libexpat | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. | Mon 26 Oct |
| CVE-2026-56403 | 6.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 has an integer overflow in storeAtts. | Sun 25 Oct |
| CVE-2026-56404 | 6.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 has an integer overflow in addBinding. | Sun 25 Oct |
| CVE-2026-56405 | 6.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 has an integer overflow in getAttributeId. | Sun 25 Oct |
| CVE-2026-56406 | 6.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | Sun 25 Oct |
| CVE-2026-56407 | 6.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | Sun 25 Oct |
| CVE-2026-56408 | 6.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 has an integer overflow in copyString. | Sun 25 Oct |
| CVE-2026-56410 | 6.9 medium | 0.00% | libexpat_project, libexpat | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | Sun 25 Oct |
| CVE-2026-56411 | 6.9 medium | 0.00% | libexpat_project, libexpat | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | Sun 25 Oct |
| CVE-2026-56409 | 6.5 medium | 0.00% | libexpat_project, libexpat | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | Sun 25 Oct |
| CVE-2026-56412 | 5.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. | Sun 25 Oct |
| CVE-2025-66382 | 5.5 medium | 0.00% | libexpat_project, libexpat | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | 19 Oct |
| CVE-2023-52426 | 5.5 medium | 0.00% | libexpat_project, libexpat | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. | 15 Oct |
| CVE-2026-56131 | 4.9 medium | 0.00% | libexpat_project, libexpat | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). | Mon 26 Oct |
42 of 42
Download these 42 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.