The slain gunman in the massacre at a Uvalde, Texas, elementary school and the suspect in the shooting at a Buffalo, N.Y., supermarket were both 18 when they bought the weapons used in the attacks, authorities say. They were too young to legally buy alcohol or cigarettes, but old enough to arm themselves with assault weapons.

The Buffalo suspect was taken to a hospital last year for a mental health evaluation, but the incident didn’t trigger New York’s “red flag” law, so he was still able to buy a gun. The Texas gunman’s mother told ABC he gave her an “uneasy feeling” at times and could “be aggressive ... if he really got mad.” But authorities say he had no known criminal or mental health history.

A look at how suspects in mass shootings over a decade obtained guns, based on police accounts, court documents and contemporaneous reporting:

Uvalde, May 24: 21 dead

Salvador Ramos legally purchased two guns in the days before the attack that killed 19 students and two teachers at Robb Elementary School — an AR-style rifle from a federally licensed gun dealer in the Uvalde area on May 17 and a second rifle on May 20. Ramos made the purchases days after turning 18, the minimum age under federal law for buying a rifle.

He also purchased several hundred rounds of ammunition. At least one of the rifles was a DDM4, made by Daniel Defense and modeled after the U.S. military’s M4 carbine rifle, though without the M4’s ability to switch to fully automatic or fire a three-round burst.

Buffalo, May 14: 10 dead

Payton Gendron legally purchased the Bushmaster XM-15 E2S used in the attack from a federally licensed gun dealer near his home in Conklin, N.Y., about 200 miles southeast of Buffalo. In an online diary that surfaced after the attack, Gendron said he bought the AR-15-style weapon in January, bought a shotgun in December and received a rifle as a Christmas present from his dad when he was 16.

Last year, Gendron was taken to a hospital for a psychiatric evaluation under a state mental health law after writing “murder-suicide” in response to a teacher’s question. New York is one of 19 states with laws that allow courts to take guns from people posing an immediate danger, but that didn’t happen with Gendron, who was 17 at the time. State police described his threat as “general in nature” and said it didn’t “specifically mention shooting or firearms.”

San Jose, May 26, 2021: Nine dead

Samuel James Cassidy legally purchased the three 9-millimeter handguns he used to kill co-workers and then himself at a Santa Clara Valley Transportation Authority rail yard. He also stockpiled a dozen guns and 25,000 rounds of ammunition at his home, which he set ablaze before the shooting, and had high-capacity magazines that may have been illegal under California law, depending on when they were purchased.

Santa Clara County’s district attorney said authorities would have sought to take Cassidy’s weapons away under the state’s red-flag law had U.S. Customs and Border Protection informed them of a “significant encounter” with Cassidy upon his return to California from a trip to the Philippines in 2016. Customs agents said in a report that Cassidy harbored “dark thoughts about harming” two specific people and had a memo book in which he expressed his hatred of the transit agency.

Boulder, Colo., March 22, 2021: 10 dead

Ahmad Al Aliwi Alissa bought a Ruger AR-556 pistol, a semiautomatic weapon with a capacity of up to 30 rounds, six days before the shooting at a grocery store, police said. Alissa was prone to sudden rages and was convicted of misdemeanor assault and sentenced to probation for attacking a high school classmate.

Colorado has a universal background check law covering almost all gun sales, but that misdemeanor would not have prevented him from buying a weapon, experts said. Had it been a felony, federal law would’ve barred his purchase.

Days before the shooting, a judge struck down city ordinances banning assault rifles and high-capacity magazines in Boulder, citing a state law prohibiting local gun bans. The National Rifle Assn. backed the lawsuit challenging the ordinances.

Atlanta, March 16, 2021: Eight dead

Robert Aaron Long purchased a 9-millimeter handgun hours before going on a shooting rampage at three massage businesses, police said. A lawyer for the gun shop said it complied with laws on federal background checks. Georgia, like the majority of states, has no waiting period to obtain a gun.

Long claimed to have a “sex addiction,” police said, and he spent time at an addiction recovery facility. Federal law bans guns for people who are “unlawful users of or addicted to a controlled substance” or who have been ordered by a court to a mental health or substance abuse treatment facility, but doesn’t mention treatment for other compulsions as a barrier to ownership.

Midland, Texas, Aug. 31, 2019: Seven dead

Seth Aaron Ator purchased an AR-style rifle through a private sale, allowing him to evade a federal background check, and fired it indiscriminately from his car into passing vehicles and shopping plazas. He also hijacked a mail truck, killing the driver.

Ator had been blocked from getting a gun in 2014 after his background check was flagged because a court determined he was mentally ill, according to a law enforcement official familiar with the matter. Private sales, which account for up to 40% of all gun sales, according to some estimates, are not subject to a federal background check.

Dayton, Ohio, Aug. 4, 2019: Nine dead

Connor Betts’ classmates said he was suspended in high school for compiling a “hit list” and a “rape list,” but authorities said nothing in his background prevented him from purchasing the AR-15-style pistol used in a shooting at a bar.

Ohio law requires that sealed records of any juvenile crimes be expunged either after five years or once the offender turns 23. Betts, who was 24 at the time of the shooting, bought the gun online from a Texas dealer. It was then shipped to a Dayton-area firearms dealer, in accordance with federal law.

El Paso, Aug. 3, 2019: 23 dead

Patrick Crusius bought an AK-47-style rifle and 1,000 rounds of hollow-point ammunition online 45 days before he walked into a Walmart and opened fire, killing 23 people and injuring two dozen others, before confessing that he had been targeting Mexicans, prosecutors said.

A Crusius family lawyer said his mother raised concerns about the purchase in a call to police on June 27. Police said she asked whether Crusius, who was 21 at the time, was old enough to buy a gun. Police said that she was assured he was and that he’d qualify if he passed a background check. Police said she expressed concern only about his safety and said she had seen no recent change in his behavior.

Virginia Beach, Va., May 31, 2019: 12 dead

Former Virginia Beach city employee DeWayne Craddock legally purchased six firearms in the three years before he opened fire on a municipal building, including the two .45-caliber pistols used in the attack.

A review of the shooting found that Craddock displayed no warning signs or “prohibited behaviors associated with a pathway to violence,” and that he had no known history of mental health treatment.

Thousand Oaks, Nov. 7, 2018: 12 dead

Ian David Long, a former Marine machine gunner who served in Afghanistan, used a legally purchased .45-caliber pistol with an extended magazine in the shooting at the Borderline Bar and Grill. California tried to outlaw high-capacity magazines, but a federal judge reversed that after a pro-gun group sued.

Months before the shooting, sheriff’s deputies called to Long’s home found him acting irrationally, but a mental health specialist didn’t feel he needed to be involuntarily committed.

Pittsburgh, Oct. 27, 2018: 11 dead

Robert Gregory Bowers had a carry license and legally owned the Colt AR-15 SP1 and three Glock .357-caliber handguns that police said he used to kill worshipers at the Tree of Life synagogue.

Bowers spent months posting rants against Jews on Gab, a social media site favored by right-wing extremists. He also posted photos of his “glock family.” Just before the attack, he posted a screed against a Jewish organization that resettles refugees. None of the rhetoric appeared to raise red flags.

Santa Fe, Texas, May 18, 2018: 10 dead

Dimitrios Pagourtzis, a 17-year-old student, used a shotgun and a .38-caliber handgun that his father purchased legally and stored in a closet at their home, authorities said. Before the attack, Pagourtzis posted a photo on social media of a T-shirt with the phrase “Born to Kill” and had writings indicating he planned to attack his high school.

Parkland, Fla., Feb. 14, 2018: 17 dead

Nikolas Cruz legally purchased a Smith & Wesson M&P 15 rifle in February 2017 from a licensed dealer a few miles from Marjory Stoneman Douglas High School, authorities said.

He had been treated at a mental health clinic but hadn’t been there in more than a year. Federal law prohibits gun purchases if a court declares a person a “mental defective” or commits that person to an institution, but not if the person seeks treatment voluntarily.

Sutherland Springs, Texas, Nov. 5, 2017: 25 dead

Devin Patrick Kelley’s history of domestic abuse barred him from buying guns. But he was able to do so because information about his crimes was never entered into a federal database used for background checks. Kelley purchased four guns, including an AR-15-style rifle found at First Baptist Church, from licensed Texas and Colorado dealers over a four-year span.

Las Vegas, Oct. 1, 2017: 58 dead

Stephen Paddock purchased 33 of the 49 weapons found in his hotel room and at his homes in the year before he opened fire on a country music festival. Paddock passed all background checks. His gradual accumulation of guns went undetected because federal law doesn’t require licensed gun dealers to alert the government about rifle purchases.

Orlando, Fla., June 12, 2016: 49 dead

Omar Mateen purchased an AR-15-style rifle, a Sig Sauer MCX and a handgun from a licensed dealer on separate days about a week before the Pulse nightclub attack. He passed a background check and had a security license that allowed him to be armed while on duty.

The FBI investigated Mateen in 2013 and 2014 over co-workers’ concerns that he’d spoken about ties to terrorist groups. Neither inquiry led to charges. Even if he’d been placed on a terrorism watch list, Congress in 2015 rejected attempts to prevent people on the list from purchasing guns.

San Bernardino, Dec. 2, 2015: 14 dead

Syed Farook and his wife, Tashfeen Malik, used weapons that the FBI said his neighbor, Enrique Marquez, legally purchased from a licensed dealer in 2011 and 2012. Marquez pleaded guilty to charges he conspired to provide support to terrorists and made false statements to acquire a firearm. He told investigators Farook asked him to buy the weapons because he would draw less attention.

Roseburg, Ore., Oct. 1, 2015: 10 dead

Christopher Harper-Mercer and his family members legally purchased the handguns and rifle used in the Umpqua Community College shooting from a licensed dealer. Investigators found six guns at the college and eight at an apartment.

Charleston, S.C., June 17, 2015: Nine dead

A drug arrest should have prevented Dylann Roof from purchasing the pistol he used at Emanuel AME Church, but a record-keeping error and background check delay enabled the transaction to go through. The FBI said a background check examiner never saw the arrest report because the wrong arresting agency was listed in state criminal history records. After three days, the gun dealer was legally permitted to complete the transaction.

Washington, Sept. 16, 2013: 12 dead

Aaron Alexis, a former reservist turned civilian contractor, passed background checks and legally purchased the shotgun used in the Washington Navy Yard shooting despite recent mental health treatment and a history of violent outbursts.

Newtown, Conn., Dec. 14, 2012: 26 dead

Adam Lanza used his mother’s weapons, including a .223-caliber semiautomatic rifle, in the massacre at Sandy Hook Elementary School. Lanza’s mother, whom he fatally shot before going to the school, also purchased the ammunition.

Aurora, Colo., July 20, 2012: 12 dead

James Holmes was receiving psychiatric treatment when he passed required federal background checks and legally purchased the weapons he used in his movie theater assault. Treatment alone did not prevent him from buying guns.

Sisak writes for the Associated Press.