Skip to content
Xmldom vulnerabilities
Newest
-
@xmldom xmldom
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
CVE-2026-83619
Fix available
8.7 High
-
@xmldom xmldom
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
CVE-2026-83618
Fix available
8.7 High
-
@xmldom xmldom
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
CVE-2026-83617
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
CVE-2026-83616
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Quadratic-memory consumption
CVE-2026-83615
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
CVE-2026-83614
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Quadratic-time attribute deduplication
CVE-2026-83613
Fix available
8.7 High
-
@xmldom xmldom
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
CVE-2026-83612
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
CVE-2026-83611
Fix available
6.9 Medium
-
@xmldom xmldom
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
CVE-2026-83610
Fix available
6.3 Medium
-
@xmldom xmldom
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
CVE-2026-83609
Fix available
8.7 High
-
@xmldom xmldom
xmldom: DocType `name` Injection Bypasses requireWellFormed
CVE-2026-83608
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Element name injection via createElement() bypasses requireWellFormed
CVE-2026-83607
Fix available
8.7 High
-
@xmldom xmldom
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
CVE-2026-83606
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83605
Fix available
8.7 High
-
xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 more
xmldom: Denial of service via uncontrolled recursion in XML serialization
CVE-2026-41673
Fix available
8.7 High
-
xmldom, red hat build of podman desktop, developer hub 1.8 +6 more +8 more
xmldom: XML injection through unvalidated DocumentType serialization
CVE-2026-41674
Fix available
8.7 High
-
xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 more
xmldom: XML node injection through unvalidated processing instruction serialization
CVE-2026-41675
Fix available
8.7 High
-
xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 more
xmldom: XML node injection through unvalidated comment serialization
CVE-2026-41672
Fix available
8.7 High
-
xmldom, red hat migration toolkit for applications 8, build of podman desktop +6 more +8 more
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
CVE-2026-34601
Fix available
7.5 High
-
xmldom, debian linux +1 more
xmldom allows multiple root nodes in a DOM
CVE-2022-39353
Fix available
9.4 Critical
-
xmldom
Misinterpretation of malicious XML input in xmldom
CVE-2021-32796
Fix available
6.5 Medium
-
xmldom, debian linux +1 more
Misinterpretation of malicious XML input
CVE-2021-21366
Fix available
4.3 Medium