Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
Oct 19, 2026A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6.CVE-2026-112094 · Other software · michaelrsweet · reported by VulDBLow 2
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'.CVE-2026-110604 · Other software · Michael R Sweet · reported by VulnCheckLow 2
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process.
- Product
- Mini-XML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xCVE-2026-44036 · Other software · OFFIS · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cMedium 6.8
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements. The xml2dcm tool and any service that converts untrusted XML to DICOM with this code are affected. The issue is fixed in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954.
- Product
- DCMTK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.dcmtk.org
Sep 24, 2026Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing.CVE-2026-88385 · Other software · reported by MITREMedium 6.5
Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion.CVE-2026-28596 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2026A vulnerability was determined in mxml up to 4.0.4.CVE-2026-5037 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2023In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used crypto.CVE-2023-21179 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-272755865
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 31, 2023Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.CVE-2023-24162 · Other software · Hutool · reported by MITRECritical 9.8
Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
- Product
- Hutool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception.CVE-2022-20500 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246540168
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 17, 2021In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity caCVE-2021-44145 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
- Product
- Apache NiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comnifi.apache.org
Dec 30, 2018In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_file function in mxmldoc.c.CVE-2018-20593 · Other software · Msweet · reported by MITREMedium 5.5
In Mini-XML (aka mxml) v2.12, there is stack-based buffer overflow in the scan_file function in mxmldoc.c.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2018In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file.CVE-2018-20592 · Other software · Msweet · reported by MITREMedium 5.5
In Mini-XML (aka mxml) v2.12, there is a use-after-free in the mxmlAdd function of the mxml-node.c file. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted xml file, as demonstrated by mxmldoc.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2018An issue has been found in Mini-XML (aka mxml) 2.12.CVE-2018-20005 · Other software · Msweet · reported by MITREMedium 5.5
An issue has been found in Mini-XML (aka mxml) 2.12. It is a use-after-free in mxmlWalkNext in mxml-search.c, as demonstrated by mxmldoc.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2018An issue has been found in Mini-XML (aka mxml) 2.12.CVE-2018-20004 · Other software · Mini-xml Project · reported by MITREHigh 8.8
An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '<order type="real">' substring, as demonstrated by testmxml.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2017The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via CVE-2016-4571 · Other software · Mini-xml Project · reported by MITREMedium 5.5
The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 3, 2017The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via craftCVE-2016-4570 · Other software · Mini-xml Project · reported by MITREMedium 5.5
The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.
- Product
- Mini-xml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 10, 2014internal/cimxml/sax/NodeFactory.java in Standards-Based Linux Instrumentation for Manageability (SBLIM) Common Information Model (CIM) Client (aka sblim-cim-cliCVE-2012-2328 · Other software · Standards Based Linux Instrumentation Project · reported by Red HatMedium 5
internal/cimxml/sax/NodeFactory.java in Standards-Based Linux Instrumentation for Manageability (SBLIM) Common Information Model (CIM) Client (aka sblim-cim-client2) before 2.1.12 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML file.
- Product
- Standards-based Linux Common Information Model Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.