How many CVEs does simplesamlphp xml-security have?

simplesamlphp xml-security has 3 published CVE records since 2023.

How many simplesamlphp xml-security CVEs are in CISA KEV?

None of simplesamlphp xml-security's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for simplesamlphp xml-security vulnerabilities?

Yes — 2 of simplesamlphp xml-security's CVEs have a known public exploit.

Which versions of simplesamlphp xml-security are affected?

129 distinct simplesamlphp xml-security versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in simplesamlphp xml-security CVEs?

simplesamlphp xml-security's CVEs most often map to these CWE weakness types: CWE-345 (Insufficient Verification of Data Authenticity), CWE-354 (Improper Validation of Integrity Check Value), CWE-918 (Server-Side Request Forgery (SSRF)).

What is the average severity of simplesamlphp xml-security CVEs?

The average CVSS base score across simplesamlphp xml-security's scored CVEs is 7.0.

simplesamlphp xml-security Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every simplesamlphp xml-security version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

0.0.12 CVEs
0.0.102 CVEs
0.0.112 CVEs
0.0.22 CVEs
0.0.42 CVEs
0.0.52 CVEs
0.0.62 CVEs
0.0.72 CVEs
0.0.82 CVEs
0.0.92 CVEs
0.2.02 CVEs
0.2.12 CVEs
0.2.22 CVEs
0.2.32 CVEs
0.2.42 CVEs
0.2.52 CVEs
0.2.62 CVEs
0.2.72 CVEs
0.3.02 CVEs
0.3.22 CVEs
0.3.32 CVEs
0.4.12 CVEs
0.4.32 CVEs
0.4.42 CVEs
0.4.52 CVEs
0.4.62 CVEs
0.4.72 CVEs
0.5.02 CVEs
0.5.12 CVEs
0.5.22 CVEs
0.5.32 CVEs
0.5.42 CVEs
0.5.52 CVEs
0.5.62 CVEs
0.5.72 CVEs
0.6.02 CVEs
0.6.12 CVEs
0.6.22 CVEs
0.6.32 CVEs
0.6.42 CVEs
0.6.52 CVEs
1.0.02 CVEs
1.0.12 CVEs
1.0.32 CVEs
1.0.42 CVEs
1.0.52 CVEs
1.0.62 CVEs
1.0.72 CVEs
1.0.82 CVEs
1.1.02 CVEs
1.1.12 CVEs
1.1.22 CVEs
1.2.02 CVEs
1.5.02 CVEs
1.5.12 CVEs
1.6.02 CVEs
1.6.12 CVEs
1.6.102 CVEs
1.6.112 CVEs
1.6.22 CVEs
1.6.32 CVEs
1.6.42 CVEs
1.6.52 CVEs
1.6.62 CVEs
1.6.72 CVEs
1.6.82 CVEs
1.6.92 CVEs
< 1.13.91 CVE
= 1.6.111 CVE
= 5.0.0-alpha.121 CVE
>= 2.0.0, < 2.3.11 CVE
1.10.01 CVE
1.11.01 CVE
1.11.11 CVE
1.11.21 CVE
1.12.01 CVE
1.12.11 CVE
1.13.01 CVE
1.13.11 CVE
1.13.21 CVE
1.13.51 CVE
1.13.61 CVE
1.13.71 CVE
1.13.81 CVE
1.6.121 CVE
1.7.01 CVE
1.7.11 CVE
1.7.21 CVE
1.7.31 CVE
1.7.41 CVE
1.7.51 CVE
1.7.61 CVE
1.8.01 CVE
1.8.11 CVE
1.8.21 CVE
1.8.31 CVE
1.8.61 CVE
1.8.71 CVE
1.9.01 CVE
1.9.11 CVE
1.9.21 CVE
1.9.31 CVE
1.9.41 CVE
1.9.51 CVE
1.9.61 CVE
2.0.01 CVE
2.0.21 CVE
2.0.31 CVE
2.0.41 CVE
2.0.51 CVE
2.0.61 CVE
2.0.71 CVE
2.0.81 CVE
2.0.91 CVE
2.1.01 CVE
2.1.11 CVE
2.1.21 CVE
2.2.01 CVE
2.3.01 CVE

Version ranges

< 1.13.91 CVE
<= 2.0.41 CVE
1.6.11 <= v <= 1.6.111 CVE
2.0.0 <= v < 2.3.11 CVE

Fixed in

> 2.0.41 CVE
1.13.91 CVE
16a5cf4a107e1b607337ff5af5fb4051fcc23ba01 CVE
2.3.11 CVE
ded07df15a53ee87a179e8bff79870ffea31e7161 CVE
f509e3083dd7870cce5880c804b51223172875811 CVE

Find a version

3 CVEs

Sort

xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
CVE-2026-32600
Public exploit
Patch
CWE-354
High · CVSS 8.2
EPSS 0.1% (5th pct)2026-03-13
Medium vulnerability · 2024-06-26
CVE-2024-34580
Public exploit
Patch
CWE-918
Medium · CVSS 5.3
EPSS 0.2% (11th pct)2024-06-26
High vulnerability · 2023-11-30
CVE-2023-49087
Patch
CWE-345
High · CVSS 7.5
EPSS 0.2% (9th pct)2023-11-30

simplesamlphp xml-security Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other simplesamlphp products

Frequently asked questions

References

Track simplesamlphp xml-security vulnerabilities