CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 1:00 AM ET)

What this means for you

This week: 3,088 CVEs published, 233 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,088; Show in the list
Critical, last 7 days: 233; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product libexpat_project:libexpat. Show all products

54 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2013-0340	Medium 6.8	expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of s… Assigned by redhat	Jan 21, 2014
CVE-2016-0718	Critical 9.8	Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Assigned by redhat	May 26, 2016
CVE-2016-4472	High 8.1	The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via… Assigned by redhat	Jun 30, 2016
CVE-2017-9233	High 7.5	XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an… Assigned by mitre	Jul 25, 2017
CVE-2018-20843	High 7.5	In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enoug… Assigned by mitre	Jun 24, 2019
CVE-2019-15903	Medium 6.5	In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumn… Assigned by mitre	Sep 4, 2019
CVE-2021-45960	High 8.8	In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memo… Assigned by mitre	Jan 1, 2022
CVE-2021-46143	High 8.1	In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Assigned by mitre	Jan 5, 2022
CVE-2022-22827	High 8.8	storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 7, 2022
CVE-2022-22826	High 8.8	nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Assigned by mitre	Jan 7, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.