WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product libexpat✕
Overview 28 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
28matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 3.6% Not applicable 27 96.4% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 28 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 28 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 3.6% Forecast only 0 0.0% No public exploit 27 96.4%
split by peak 16 / year
Not applicable: 27Outside Waratek scope: 1 Medium: 28 not blocked: 28 No public exploit: 27Proof of concept only: 1
20092 Not applicable2 Medium2 not blocked2 No public exploit2 20100 20110 20123 Not applicable3 Medium3 not blocked3 No public exploit3 20130 20141 Not applicable1 Medium1 not blocked1 No public exploit1 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20161 Not applicable1 Medium1 not blocked1 No public exploit1 20170 20180 20190 20200 20210 20221 Not applicable1 Medium1 not blocked1 No public exploit1 20230 20242 Outside Waratek scope1 Not applicable1 Medium2 not blocked2 Proof of concept only1 No public exploit1 20251 Not applicable1 Medium1 not blocked1 No public exploit1 202616 Not applicable16 Medium16 not blocked16 No public exploit16
201020122014201620182020202220242026
28 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-56412 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
CVE-2026-56411 Medium 2026-06-21 Not applicable No public exploit xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56410 Medium 2026-06-21 Not applicable No public exploit xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56409 Medium 2026-06-21 Not applicable No public exploit xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-56408 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56407 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56406 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56405 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56404 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56403 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56132 Medium 2026-06-19 Not applicable No public exploit In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56131 Medium 2026-06-19 Not applicable No public exploit libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-50219 Medium 2026-06-04 Not applicable No public exploit libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-32778 Medium 2026-03-16 Not applicable No public exploit libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-32777 Medium 2026-03-16 Not applicable No public exploit libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32776 Medium 2026-03-16 Not applicable No public exploit libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2025-66382 Medium 2025-11-28 Not applicable No public exploit In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2024-50602 Medium 2024-10-27 Outside Waratek scope Proof of concept only An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
CVE-2023-52426 Medium 2024-02-04 Not applicable No public exploit libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
CVE-2022-25313 Medium 2022-02-18 Not applicable No public exploit In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
CVE-2012-6702 Medium 2016-06-16 Not applicable No public exploit Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
CVE-2015-1283 Medium 2015-07-23 Not applicable No public exploit Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
CVE-2013-0340 Medium 2014-01-21 Not applicable No public exploit expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
CVE-2012-1148 Medium 2012-07-03 Not applicable No public exploit Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
CVE-2012-1147 Medium 2012-07-03 Not applicable No public exploit readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.
CVE-2012-0876 Medium 2012-07-03 Not applicable No public exploit The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
CVE-2009-3560 Medium 2009-12-04 Not applicable No public exploit The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-3720 Medium 2009-11-03 Not applicable No public exploit The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.