8
CVEs
0
Critical
1
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
5
LOW
2
Monthly CVE Trend
Affected Products (30)
Libxml2
90
Debian Linux
52
Ubuntu Linux
40
Iphone Os
30
Tvos
26
Watchos
25
Mac Os X
25
Enterprise Linux Server
22
Libxslt
22
Enterprise Linux Workstation
21
Enterprise Linux Desktop
21
Fedora
17
Active Iq Unified Manager
14
Clustered Data Ontap
13
Icewall Federation Agent
13
Opensuse
12
Enterprise Linux
12
Icewall File Manager
11
Enterprise Linux Server Aus
11
Manageability Software Development Kit
11
Jboss Core Services
11
Clustered Data Ontap Antivirus Connector
11
Web Gateway
10
Enterprise Linux Server Tus
10
Ontap Select Deploy Administration Utility
10
H410s Firmware
9
H300s Firmware
9
Enterprise Linux Server Eus
9
H500s Firmware
9
Chrome
9
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86140 | Stack-based buffer overflow in libxml2 before 2.15.4 exposes applications that perform DTD element validation to potential arbitrary code execution via the `xmlSnprintfElements` function in `valid.c`. The function performs unbounded `strcat` calls into a caller-supplied fixed-size stack buffer when formatting element content model descriptions, with no remaining-capacity check before appending parentheses - allowing a crafted XML document with a sufficiently complex element content model to overflow adjacent stack memory. The fix is confirmed in libxml2 2.15.4 via a specific GitHub commit; no public exploit or active exploitation has been identified at time of analysis. | HIGH | 8.0 | 0.1% | 40 |
|
| CVE-2026-86142 | Heap-based buffer overflow in libxml2 before 2.15.4 allows arbitrary code execution via a crafted XML document containing an excessively long XPointer expression. The root cause is integer length saturation in `xmlStrlen` within `xmlXPtrEvalXPtrPart`: when the XPointer string length overflows to zero, the subsequent heap allocation is undersized, enabling a controlled write beyond the buffer boundary. Any application using libxml2's XPointer evaluation on attacker-influenced XML is affected. No public exploit is identified at time of analysis, though a vendor-confirmed patch (v2.15.4) is available with a corresponding commit diff. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-86138 | Heap-based buffer overflow in libxml2 before 2.15.4 allows an attacker who can supply maliciously crafted XML with oversized namespace-qualified names to corrupt heap memory within any application linking against the library, potentially enabling code execution or sensitive memory disclosure. The root cause is an integer overflow in xmlDictAddQString (dict.c) during dictionary string-pool growth, where unchecked multiplication and addition of the buffer size and string lengths could wrap around, producing an undersized heap allocation subsequently overwritten with full-length data. No public exploit code or CISA KEV listing is present at time of analysis, though the pervasive embedding of libxml2 across OS stacks, language runtimes, and application middleware substantially widens the potential attack surface. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-86143 | Integer overflow in libxml2 before 2.15.4 passes negative-length values into application-level XML write callbacks when output buffer sizes reach or exceed INT_MAX, enabling out-of-bounds memory reads or writes within any callback that trusts the supplied length parameter. The root cause is a type mismatch: xmlBufUse() returns size_t, but xmlOutputWriteCallback expects int - without an overflow guard, buffers of sufficient size silently wrap to negative values. Applications embedding libxml2 with custom output callbacks and processing attacker-influenced large XML payloads face C:H/I:H impact; the severity is callback-implementation-dependent. No public exploit has been identified at time of analysis. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-86139 | Integer overflow in libxml2's xmlURIEscapeStr function (uri.c) before version 2.15.4 creates a heap memory corruption primitive with potential arbitrary read/write impact. When processing a URI string whose computed escape-output length wraps to zero via arithmetic overflow, the function proceeds with a corrupted buffer size, enabling writes beyond the allocated region. Fixed in v2.15.4 via commit 8edbbdb09f24d26a2f900141fddc2b9d014f53b0; no public exploit code or CISA KEV listing identified at time of analysis. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-86144 | Flag-propagation failure in libxml2's XInclude processor before version 2.15.4 allows security-critical parse options - most notably XML_PARSE_NONET, which blocks outbound network entity loading - to be silently discarded when xmlXIncludeProcess or xmlXIncludeProcessTree resolves included sub-documents. Applications that rely on XML_PARSE_NONET as a sandboxing boundary may unknowingly initiate outbound HTTP connections to attacker-controlled hosts, enabling server-side request forgery (SSRF), XML external entity (XXE) data extraction, or denial of service via intentionally slow network responses. No public exploit identified at time of analysis, and no CISA KEV listing is present. | MEDIUM | 5.6 | 0.2% | 28 |
|
| CVE-2026-86137 | Out-of-bounds read in libxml2's XML regular expression parser exposes all versions before 2.15.4 to a limited availability impact when processing malformed character group patterns. The NXT(index) macro in xmlregexp.c performed a direct array dereference without verifying the index stays within the parsed string's length, allowing a specially crafted regexp pattern to read one byte past the allocated buffer. The vendor-released fix in v2.15.4 adds a bounds guard returning 0 for out-of-bounds accesses; no public exploit is identified at time of analysis. | LOW | 2.9 | 0.1% | 15 |
|
| CVE-2026-86141 | NULL pointer dereference in libxml2's xmlRegNewParserCtxt() function crashes any application invoking the XML regular-expression engine under memory-pressure conditions. Versions before 2.15.4 call strlen() on the return value of xmlStrdup() without first verifying the pointer is non-NULL; when strdup() fails due to memory exhaustion, the subsequent strlen(NULL) causes a process crash. No confidentiality or integrity impact is possible - the vulnerability is limited to a local, high-complexity denial-of-service. No public exploit or CISA KEV listing exists; the fix shipped in libxml2 2.15.4. | LOW | 2.9 | 0.1% | 15 |
|