Open Source libxml2

productDE

cpe:/a:xmlsoft:libxml2:-

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical15high18medium1low

updated 2026-10-27

vulnerabilities (45)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2016-1839US	medium5.5	7.35% (94th)	Exploit	no fix	2016-05-20	—
CVE-2016-3627US	high7.5	7.03% (94th)	Exploit	no fix	2016-05-17	—
CVE-2016-1838US	medium5.5	7.00% (94th)	Exploit	no fix	2016-05-20	—
CVE-2015-8710US	critical9.8	4.92% (92nd)	Exploit	no fix	2016-04-11	—
CVE-2016-4447US	high7.5	14.0% (97th)	—	no fix	2016-06-09	—
CVE-2014-0191US	medium4.3	8.14% (95th)	—	no fix	2015-01-21	—
CVE-2016-4448US	critical9.8	7.04% (94th)	—	no fix	2016-06-09	—
CVE-2015-1819US	medium5.0	6.29% (94th)	—	no fix	2015-08-14	—
CVE-2016-1762US	high8.1	6.13% (93rd)	—	no fix	2016-03-24	—
CVE-2016-4483US	high7.5	6.00% (93rd)	—	no fix	2017-04-11	—
CVE-2016-1835US	high8.8	5.58% (93rd)	—	no fix	2016-05-20	—
CVE-2015-8241US	medium6.4	5.39% (93rd)	—	no fix	2015-12-15	—
CVE-2016-3705US	high7.5	5.10% (92nd)	—	no fix	2016-05-17	—
CVE-2015-8806US	high7.5	4.96% (92nd)	—	no fix	2016-04-13	—
CVE-2017-9048US	high7.5	4.85% (92nd)	—	no fix	2017-05-18	—
CVE-2017-9050US	high7.5	4.63% (92nd)	—	no fix	2017-05-18	—
CVE-2017-9049US	high7.5	4.63% (92nd)	—	no fix	2017-05-18	—
CVE-2016-1834US	high7.8	4.62% (92nd)	—	no fix	2016-05-20	—
CVE-2015-7942US	medium6.8	4.48% (91st)	—	no fix	2015-11-18	—
CVE-2016-1837US	medium5.5	4.45% (91st)	—	no fix	2016-05-20	—
CVE-2016-1836US	medium5.5	4.27% (91st)	—	no fix	2016-05-20	—
CVE-2015-8242US	medium5.8	4.25% (91st)	—	no fix	2015-12-15	—
CVE-2014-3660US	medium5.0	3.78% (90th)	—	no fix	2014-11-04	—
CVE-2013-0339US	medium6.8	3.61% (89th)	—	no fix	2014-01-21	—
CVE-2016-1840US	high7.8	3.24% (88th)	—	no fix	2016-05-20	—
CVE-2017-9047US	high7.5	3.16% (88th)	—	no fix	2017-05-18	—
CVE-2015-7941US	medium4.3	3.06% (88th)	—	no fix	2015-11-18	—
CVE-2016-9318US	medium5.5	2.94% (87th)	—	no fix	2016-11-16	—
CVE-2013-0338US	medium4.3	2.86% (87th)	—	no fix	2013-04-25	—
CVE-2016-1833US	medium5.5	2.56% (85th)	—	no fix	2016-05-20	—
CVE-2016-2073US	medium6.5	2.31% (83rd)	—	no fix	2016-02-12	—
CVE-2016-4449US	high7.1	1.66% (77th)	—	no fix	2016-06-09	—
CVE-2025-49796US	—	1.56% (75th)	—	no fix	2025-06-16	—
CVE-2025-6021US	—	1.37% (72nd)	—	no fix	2025-06-12	—
CVE-2016-3709US	medium6.1	1.31% (71st)	—	no fix	2022-07-28	—
CVE-2026-0990US	—	0.95% (61st)	—	no fix	2026-01-15	—
CVE-2025-49794US	—	0.83% (57th)	—	no fix	2025-06-16	—
CVE-2025-49795US	—	0.59% (48th)	—	no fix	2025-06-16	—
CVE-2026-0989US	—	0.53% (45th)	—	no fix	2026-01-15	—
CVE-2026-0992US	—	0.46% (40th)	—	no fix	2026-01-15	—
CVE-2025-6170US	low2.5	0.32% (25th)	—	no fix	2025-06-16	—
CVE-2026-1757US	—	0.22% (13th)	—	no fix	2026-02-02	—
CVE-2026-76781US	—	0.17% (6th)	—	no fix	2026-09-17	—
CVE-2025-9714US	medium5.5	0.16% (5th)	—	no fix	2025-09-10	—
CVE-2026-11979US	high7.8	0.15% (4th)	—	no fix	2026-06-29	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer22 CVEs
CWE-125Out-of-bounds Read9 CVEs
CWE-122Heap-based Buffer Overflow5 CVEs
CWE-674Uncontrolled Recursion5 CVEs
CWE-121Stack-based Buffer Overflow4 CVEs
CWE-611Improper Restriction of XML External Entity Reference4 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-416Use After Free3 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)45 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan