Multiple Unfixed Vulnerabilities in Libexpat Disclosed
Article Content
- •Libexpat has multiple unfixed vulnerabilities, including CVE-2026-115506.
- •CVE-2026-115506 has a CVSS score of 8.7, indicating high severity.
- •Developers should monitor the status of these vulnerabilities and apply patches promptly.
Libexpat has reported several unfixed non-public vulnerabilities, including CVE-2026-115506, which addresses amplification attacks through entity expanded sizes. The vulnerabilities were identified in various pull requests and affect all releases of the Expat library. CVE-2026-115506 was published on October 22, 2026, with a CVSS score of 8.7, indicating a high severity. Other vulnerabilities include CVE-2025-66382, a low severity DoS issue, and several others with various impacts. The status of these vulnerabilities remains unfixed, posing risks to applications relying on Libexpat for XML parsing. Developers are urged to monitor these issues closely and apply patches as they become available.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2025-66382 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What vulnerabilities are currently unfixed in Libexpat?
How severe is CVE-2026-115506?
What should developers do regarding these vulnerabilities?
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…