Overview 63 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
63matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
2
3.2%
Not applicable
61
96.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
63
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
63
100.0%
split by
peak 26 / year
20092
Not applicable2
Medium2
not blocked2
No public exploit2
20100
20110
20123
Not applicable3
Medium3
not blocked3
No public exploit3
20130
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20164
Not applicable4
Critical1
High2
Medium1
not blocked4
No public exploit4
20172
Not applicable2
High2
not blocked2
No public exploit2
20180
20192
Not applicable2
High2
not blocked2
No public exploit2
20200
20210
202214
Outside Waratek scope2
Not applicable12
Critical6
High7
Medium1
not blocked14
No public exploit14
20230
20246
Not applicable6
Critical3
High2
Medium1
not blocked6
No public exploit6
20252
Not applicable2
High1
Medium1
not blocked2
No public exploit2
202626
Not applicable26
High9
Medium16
Low1
not blocked26
No public exploit26
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-118370 | High | 2026-10-28 | Not applicable | No public exploit | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory. |
| CVE-2026-117610 | High | 2026-10-28 | Not applicable | No public exploit | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application. |
| CVE-2026-113351 | High | 2026-10-20 | Not applicable | No public exploit | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated. |
| CVE-2026-76957 | High | 2026-08-20 | Not applicable | No public exploit | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412. |
| CVE-2026-76956 | High | 2026-08-20 | Not applicable | No public exploit | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content. |
| CVE-2026-66046 | High | 2026-08-18 | Not applicable | No public exploit | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. |
| CVE-2026-56412 | Medium | 2026-06-21 | Not applicable | No public exploit | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. |
| CVE-2026-56411 | Medium | 2026-06-21 | Not applicable | No public exploit | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. |
| CVE-2026-56410 | Medium | 2026-06-21 | Not applicable | No public exploit | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. |
| CVE-2026-56409 | Medium | 2026-06-21 | Not applicable | No public exploit | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. |
| CVE-2026-56408 | Medium | 2026-06-21 | Not applicable | No public exploit | libexpat before 2.8.2 has an integer overflow in copyString. |
| CVE-2026-56407 | Medium | 2026-06-21 | Not applicable | No public exploit | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. |
| CVE-2026-56406 | Medium | 2026-06-21 | Not applicable | No public exploit | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. |
| CVE-2026-56405 | Medium | 2026-06-21 | Not applicable | No public exploit | libexpat before 2.8.2 has an integer overflow in getAttributeId. |
| CVE-2026-56404 | Medium | 2026-06-21 | Not applicable | No public exploit | libexpat before 2.8.2 has an integer overflow in addBinding. |
| CVE-2026-56403 | Medium | 2026-06-21 | Not applicable | No public exploit | libexpat before 2.8.2 has an integer overflow in storeAtts. |
| CVE-2026-56132 | Medium | 2026-06-19 | Not applicable | No public exploit | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. |
| CVE-2026-56131 | Medium | 2026-06-19 | Not applicable | No public exploit | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). |
| CVE-2026-50219 | Medium | 2026-06-04 | Not applicable | No public exploit | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, |
| CVE-2026-45186 | High | 2026-05-10 | Not applicable | No public exploit | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. |
| CVE-2026-41080 | High | 2026-04-16 | Not applicable | No public exploit | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. |
| CVE-2026-32778 | Medium | 2026-03-16 | Not applicable | No public exploit | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. |
| CVE-2026-32777 | Medium | 2026-03-16 | Not applicable | No public exploit | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. |
| CVE-2026-32776 | Medium | 2026-03-16 | Not applicable | No public exploit | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. |
| CVE-2026-25210 | High | 2026-01-30 | Not applicable | No public exploit | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation. |
| CVE-2026-24515 | Low | 2026-01-23 | Not applicable | No public exploit | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. |
| CVE-2025-66382 | Medium | 2025-11-28 | Not applicable | No public exploit | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. |
| CVE-2025-59375 | High | 2025-09-15 | Not applicable | No public exploit | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
| CVE-2024-45492 | Critical | 2024-08-30 | Not applicable | No public exploit | An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). |
| CVE-2024-45491 | Critical | 2024-08-30 | Not applicable | No public exploit | An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). |
| CVE-2024-45490 | Critical | 2024-08-30 | Not applicable | No public exploit | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. |
| CVE-2024-28757 | High | 2024-03-10 | Not applicable | No public exploit | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). |
| CVE-2023-52426 | Medium | 2024-02-04 | Not applicable | No public exploit | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. |
| CVE-2023-52425 | High | 2024-02-04 | Not applicable | No public exploit | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. |
| CVE-2022-43680 | High | 2022-10-24 | Not applicable | No public exploit | In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. |
| CVE-2022-40674 | High | 2022-09-14 | Not applicable | No public exploit | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. |
| CVE-2022-25314 | High | 2022-02-18 | Not applicable | No public exploit | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. |
| CVE-2022-25313 | Medium | 2022-02-18 | Not applicable | No public exploit | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. |
| CVE-2022-25236 | Critical | 2022-02-16 | Not applicable | No public exploit | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
| CVE-2022-25235 | Critical | 2022-02-16 | Not applicable | No public exploit | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. |
| CVE-2022-23990 | High | 2022-01-26 | Outside Waratek scope | No public exploit | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. |
| CVE-2022-23852 | Critical | 2022-01-24 | Outside Waratek scope | No public exploit | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. |
| CVE-2022-22827 | High | 2022-01-10 | Not applicable | No public exploit | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22826 | High | 2022-01-10 | Not applicable | No public exploit | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22825 | High | 2022-01-10 | Not applicable | No public exploit | lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22824 | Critical | 2022-01-10 | Not applicable | No public exploit | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22823 | Critical | 2022-01-10 | Not applicable | No public exploit | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22822 | Critical | 2022-01-10 | Not applicable | No public exploit | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2019-15903 | High | 2019-09-04 | Not applicable | No public exploit | In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. |
| CVE-2018-20843 | High | 2019-06-24 | Not applicable | No public exploit | In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks). |
| CVE-2017-11742 | High | 2017-07-30 | Not applicable | No public exploit | The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking. |
| CVE-2017-9233 | High | 2017-07-25 | Not applicable | No public exploit | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. |
| CVE-2016-4472 | High | 2016-06-30 | Not applicable | No public exploit | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716. |
| CVE-2016-5300 | High | 2016-06-16 | Not applicable | No public exploit | The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. |
| CVE-2012-6702 | Medium | 2016-06-16 | Not applicable | No public exploit | Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function. |
| CVE-2016-0718 | Critical | 2016-05-26 | Not applicable | No public exploit | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. |
| CVE-2015-1283 | Medium | 2015-07-23 | Not applicable | No public exploit | Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. |
| CVE-2013-0340 | Medium | 2014-01-21 | Not applicable | No public exploit | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. |
| CVE-2012-1148 | Medium | 2012-07-03 | Not applicable | No public exploit | Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities. |
| CVE-2012-1147 | Medium | 2012-07-03 | Not applicable | No public exploit | readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files. |
| CVE-2012-0876 | Medium | 2012-07-03 | Not applicable | No public exploit | The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value. |
| CVE-2009-3560 | Medium | 2009-12-04 | Not applicable | No public exploit | The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720. |
| CVE-2009-3720 | Medium | 2009-11-03 | Not applicable | No public exploit | The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625. |