Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,188All CVEsplus 19,170 rejected
- 699Last 24 hours5,122 in the last 7 days
- 17,191Last 30 days1,518 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 20 | 4 | 0 | 25 | 27 |
| 2025 | 0 | 1 | 0 | 1 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-128241 | libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directorylibexpat project · libexpat | Medium4.1 |
| CVE-2026-76957 | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to…libexpat project · libexpat | Medium4.9 |
| CVE-2026-76956 | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to…libexpat project · libexpat | Medium5.9 |
| CVE-2026-66046 | Expat Denial of Service via storeAtts() Quadratic Complexitylibexpat project · libexpat | High8.7 |
| CVE-2026-72522 | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode…libexpat project · libexpat | Medium6.2 |
| CVE-2026-56412 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers…libexpat project · libexpat | Medium4.9 |
| CVE-2026-56411 | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56410 | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56409 | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.libexpat project · libexpat | Medium6.5 |
| CVE-2026-56408 | libexpat before 2.8.2 has an integer overflow in copyString.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56407 | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56406 | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56405 | libexpat before 2.8.2 has an integer overflow in getAttributeId.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56404 | libexpat before 2.8.2 has an integer overflow in addBinding.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56403 | libexpat before 2.8.2 has an integer overflow in storeAtts.libexpat project · libexpat | Medium6.9 |
| CVE-2026-56132 | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there…libexpat project · libexpat | Medium6.9 |
| CVE-2026-56131 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a…libexpat project · libexpat | Medium4.9 |
| CVE-2026-50219 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within…libexpat project · libexpat | Medium4.9 |
| CVE-2026-45186 | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.libexpat project · libexpat | Low2.9 |
| CVE-2026-41080 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.libexpat project · libexpat | Low2.9 |
| CVE-2026-32778 | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.libexpat project · libexpat | Low2.9 |
| CVE-2026-32777 | libexpat before 2.7.5 allows an infinite loop while parsing DTD content.libexpat project · libexpat | Medium4.0 |
| CVE-2026-32776 | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.libexpat project · libexpat | Medium4.0 |
| CVE-2026-25210 | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer…libexpat project · libexpat | Medium6.9 |
| CVE-2026-24515 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.libexpat project · libexpat | Low2.9 |
| CVE-2025-66382 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.libexpat project · libexpat | Low2.9 |
| CVE-2025-59375 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.libexpat project · libexpat | High7.5 |