XM
Vendor
xmldom
21
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-83619 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser |
| CVE-2026-83618 | XM xmldom @xmldom | 8.7 | Sep 1 | xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator |
| CVE-2026-83617 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator |
| CVE-2026-83616 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: Processing Instruction Target Injection Bypasses requireWellFormed |
| CVE-2026-83615 | XM xmldom @xmldom | 8.7 | Sep 1 | xmldom: Quadratic-memory consumption |
| CVE-2026-83614 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge |
| CVE-2026-83613 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: Quadratic-time attribute deduplication |
| CVE-2026-83612 | XM xmldom @xmldom | 8.7 | Sep 1 | xmldom: HTML raw-text closing-tag case mismatch causes output amplification |
| CVE-2026-83611 | XM xmldom xmldom | 6.9 | Sep 1 | xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content |
| CVE-2026-83610 | XM xmldom @xmldom | 6.3 | Sep 1 | xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization |
| CVE-2026-83609 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path |
| CVE-2026-83608 | XM xmldom @xmldom | 8.7 | Sep 1 | xmldom: DocType `name` Injection Bypasses requireWellFormed |
| CVE-2026-83607 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: Element name injection via createElement() bypasses requireWellFormed |
| CVE-2026-83606 | XM xmldom @xmldom | 8.7 | Sep 1 | xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions |
| CVE-2026-83605 | XM xmldom xmldom | 8.7 | Sep 1 | xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed |
| CVE-2026-41675 | XM xmldom xmldom | 7.5 | May 7 | xmldom: XML node injection through unvalidated processing instruction serialization |
| CVE-2026-41674 | XM xmldom xmldom | 7.5 | May 7 | xmldom: XML injection through unvalidated DocumentType serialization |
| CVE-2026-41673 | XM xmldom xmldom | 7.5 | May 7 | xmldom: Denial of service via uncontrolled recursion in XML serialization |
| CVE-2026-41672 | XM xmldom xmldom | 7.5 | May 7 | xmldom: XML node injection through unvalidated comment serialization |
| CVE-2026-34601 | XM xmldom xmldom | 7.5 | Apr 2 | xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion |
| CVE-2022-39353 | XM xmldom xmldom | 9.8 | Nov 2 | xmldom allows multiple root nodes in a DOM |