Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Oct 14, 2026Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'.CVE-2026-110604 · Other software · Michael R Sweet · reported by VulnCheckLow 2
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
- Product
- Mini-XML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing.CVE-2026-88385 · Other software · reported by MITREMedium 6.5
Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022A stack buffer overflow exists in Mini-XML v3.2.CVE-2021-42860 · Other software · Mini-xml Project · reported by MITREHigh 7.5
A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611. NOTE: it is unclear whether this input is allowed by the API specification
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service.CVE-2021-42859 · Other software · Mini-xml Project · reported by MITREHigh 7.5
A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2018In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_file function in mxmldoc.c.CVE-2018-20593 · Other software · Msweet · reported by MITREMedium 5.5
In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_file function in mxmldoc.c.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2018In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file.CVE-2018-20592 · Other software · Msweet · reported by MITREMedium 5.5
In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted xml file, as demonstrated by mxmldoc.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2018An issue has been found in Mini-XML (aka mxml) 2.12.CVE-2018-20005 · Other software · Msweet · reported by MITREMedium 5.5
An issue has been found in Mini-XML (aka mxml) 2.12. It is a use-after-free in mxmlWalkNext in mxml-search.c, as demonstrated by mxmldoc.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2018An issue has been found in Mini-XML (aka mxml) 2.12.CVE-2018-20004 · Other software · Mini-xml Project · reported by MITREHigh 8.8
An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '<order type="real">' substring, as demonstrated by testmxml.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2017The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via CVE-2016-4571 · Other software · Mini-xml Project · reported by MITREMedium 5.5
The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 3, 2017The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via craftCVE-2016-4570 · Other software · Mini-xml Project · reported by MITREMedium 5.5
The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.