libxml2-main vulnerabilities
CVEs whose affected-version data names the libxml2-main package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-76781Medium· 5.5A flaw was found in libxml2
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` …
CVE-2026-74860High· 8.5A flaw was found in libxml2 with Python bindings enabled
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This…
CVE-2025-7425High· 7.8PoCA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the pro…
CVE-2025-49796Critical· 9.1A vulnerability was found in libxml2
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, res…
CVE-2025-49795High· 7.5A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions
A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
CVE-2025-49794Critical· 9.1A use-after-free vulnerability was found in libxml2
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to …