These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A low-severity CVE-2026-86137 vulnerability exists in libxml2 versions prior to 2.15.4. An out-of-bounds read can occur in the xmlFAParsePosCharGroup function. The CVE record was published on 2026-09-05T05:17:11.490Z and was last modified on 2026-09-15T19:46:11.827Z. The NVD entry is currently Analyzed. This vulnerability affects libxml2 deployments, which defenders should assess for exposure and prioriti [truncated]
CVE-2026-86144 is a security vulnerability in libxml2 before version 2.15.4, where xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags, potentially leading to XML external entity injection, SSRF, or denial of service. The vulnerability has a CVSS score of 5.6 and is classified as MEDIUM severity. It affects libxml2 installations and requires verification of version and patching to pr [truncated]
CVE-2026-86143 is a security vulnerability in libxml2 before version 2.15.4, caused by an inconsistency in xmlOutputWriteCallback and xmlBufUse, leading to negative lengths reaching write callbacks due to a lack of integer overflow check before calling the write callback. This issue has security implications for various uses of the length value within callbacks.
CVE-2026-86142 is a heap-based buffer overflow vulnerability in libxml2 before version 2.15.4. The vulnerability is caused by xmlXPtrEval xpointer length saturation in xmlXPtrEvalXPtrPart. This CVE was published on 2026-09-05T05:17:13.133Z and was last modified on 2026-09-14T14:17:15.313Z. Affected product deployments should be verified, and owners should be assigned for follow-up. The official advisory o [truncated]
CVE-2026-86141 is a vulnerability in xmlregexp in libxml2 before 2.15.4, which has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure. The vulnerability has a CVSS score of 2.9 and a severity of LOW. This issue can cause crashes or instability in systems and applications using libxml2. Defenders and administrators should assess exposure and prioritize verification and remediation eff [truncated]
CVE-2026-86140 is a HIGH-severity vulnerability in libxml2 before version 2.15.4, caused by a stack-based buffer overflow in xmlSnprintfElements in valid.c. The CVE record was published on 2026-09-05T05:17:12.877Z and was last modified on 2026-09-15T19:39:17.010Z. The NVD entry is currently Analyzed. Defenders responsible for libxml2 deployments should assess exposure and prioritize verification and patch [truncated]
CVE-2026-86139 is a medium-severity vulnerability in libxml2 before 2.15.4, where xmlURIEscapeStr in uri.c has an integer overflow. The CVE record was published on 2026-09-05T05:17:12.730Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects libxml2 versions before 2.15.4, and defenders should assess exposure and prioritize patching. The vulnerability could [truncated]
CVE-2026-86138 is a MEDIUM-severity vulnerability in libxml2 before version 2.15.4, caused by an integer overflow and resultant heap-based buffer overflow in xmlDictAddQString in dict.c. This vulnerability requires verification and potential patching to prevent exploitation. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The CVE reco [truncated]