xmlsoft
OSS Librariesoss-project
Top products
Latest CVEs
The 15 most recently published vulnerabilities affecting xmlsoft.
- CVE-2026-86144In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without ...5.6
- CVE-2026-86143In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calli...6.9
- CVE-2026-86142In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.6.9
- CVE-2026-86141xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.2.9
- CVE-2026-86140In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.8.0
- CVE-2026-86139In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.6.9
- CVE-2026-86138In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.6.9
- CVE-2026-86137In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.2.9
- CVE-2026-11979Stack-Based Buffer Overflow in libxml27.8
- CVE-2026-6732Libxml2: libxml2: denial of service via crafted xsd-validated document6.5
- CVE-2026-0992Libxml2: libxml2: denial of service via crafted xml catalogs2.9
- CVE-2026-0989Libxml2: unbounded relaxng include recursion leading to stack overflow3.7
- CVE-2026-0990Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing5.9
- CVE-2025-9714Stack overflow in libxml26.2
- CVE-2025-8732libxml2 xmlcatalog xmlParseSGMLCatalog recursion3.3