xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
CVE-2026-83617
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 un
#advisory
共收录 23717 条相关情报。
← 返回所有主题xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
CVE-2026-83616
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: Quadratic-memory consumption
CVE-2026-83615
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
CVE-2026-83614
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: Quadratic-time attribute deduplication
CVE-2026-83613
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
CVE-2026-83612
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-bet
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
CVE-2026-83611
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
CVE-2026-83610
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
CVE-2026-83609
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 unt
xmldom: DocType `name` Injection Bypasses requireWellFormed
CVE-2026-83608
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: Element name injection via createElement() bypasses requireWellFormed
CVE-2026-83607
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
CVE-2026-83606
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-bet
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83605
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
Hugging Face Transformers library writes remote code to disk prior to consent check
CVE-2026-80047
A vulnerability in Hugging Face Transformers (versions >= 4.49.0 and <= 5.8.1) allows remote Python files to be written
Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions
CVE-2026-84200
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combi
Kyverno before 1.16.2 SSRF via APICall Feature
CVE-2026-84199
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field
Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
CVE-2026-84196
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authentica
Kyverno before 1.16.4 Credential Leak via apiCall
CVE-2026-84195
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests i
LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
CVE-2026-84194
LibreNMS versions >= 23.10.0 and getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/dom
LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
CVE-2026-84193
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render un