Input Validation and Logic

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-depende…CVE-2016-3705Xmlsoft · 5.1% likely

   CWE-20

2. XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attac…CVE-2016-4449Xmlsoft · 1.7% likely

   CWE-20

3. In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be v…CVE-2025-32415xmlsoft · CVSS 2.9 · 0.6% likely

   CWE-1284

4. In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in x…CVE-2025-32414xmlsoft · CVSS 5.6 · 0.4% likely

   CWE-393

5. xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.CVE-2026-86141xmlsoft · CVSS 2.9 · 0.2% likely

   CWE-252

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.