113
CVEs
11
Critical
41
High
0
KEV
35
PoC
18
Unpatched C/H
61.1%
Patch Rate
2.7%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
41
MEDIUM
51
LOW
10
Monthly CVE Trend
Affected Products (30)
Libxml2
90
Debian Linux
52
Ubuntu Linux
40
Iphone Os
30
Tvos
26
Watchos
25
Mac Os X
25
Enterprise Linux Server
22
Libxslt
22
Enterprise Linux Workstation
21
Enterprise Linux Desktop
21
Fedora
17
Active Iq Unified Manager
14
Clustered Data Ontap
13
Icewall Federation Agent
13
Opensuse
12
Enterprise Linux
12
Icewall File Manager
11
Enterprise Linux Server Aus
11
Manageability Software Development Kit
11
Jboss Core Services
11
Clustered Data Ontap Antivirus Connector
11
Web Gateway
10
Enterprise Linux Server Tus
10
Ontap Select Deploy Administration Utility
10
H410s Firmware
9
H300s Firmware
9
Enterprise Linux Server Eus
9
H500s Firmware
9
Chrome
9
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-6021 | Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affected systems via crafted XML input. The vulnerability affects libxml2 directly and downstream Red Hat products including OpenShift Container Platform 4.12-4.19, RHEL 7-10, and JBoss Core Services. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N), EPSS 0.75% (73rd percentile), and publicly available exploit code, this represents a moderate real-world risk focused on availability disruption rather than code execution or data compromise. | HIGH | 7.5 | 0.8% | 68 |
PoC
|
| CVE-2016-4658 | xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 17.7%. | CRITICAL | 9.8 | 17.7% | 67 |
|
| CVE-2016-1762 | The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 8.1 | 4.3% | 65 |
PoC
|
| CVE-2016-1834 | Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.8 | 2.4% | 61 |
PoC
|
| CVE-2016-1840 | Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.8 | 2.1% | 61 |
PoC
|
| CVE-2017-9047 | A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 2.7% | 60 |
PoC
No patch
|
| CVE-2016-4447 | The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.5 | 2.1% | 60 |
PoC
|
| CVE-2017-16932 | parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 22.0%. | HIGH | 7.5 | 22.0% | 59 |
|
| CVE-2024-55549 | xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. Rated high severity (CVSS 7.8), this vulnerability is no authentication required. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.1% | 59 |
PoC
|
| CVE-2025-24855 | numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. Rated high severity (CVSS 7.8), this vulnerability is no authentication required. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.0% | 59 |
PoC
|
| CVE-2021-3516 | There's a flaw in libxml2's xmllint in versions before 2.9.11. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.8 | 2.0% | 59 |
PoC
|
| CVE-2016-4483 | The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 7.5 | 1.3% | 59 |
PoC
|
| CVE-2013-1969 | Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 1.0% | 58 |
PoC
No patch
|
| CVE-2016-1839 | The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 10.8%. | MEDIUM | 5.5 | 10.8% | 58 |
PoC
|
| CVE-2016-1838 | The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 10.7%. | MEDIUM | 5.5 | 10.7% | 58 |
PoC
|