CVE-2026-83614

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

CVE-2026-44458 Hono: CSS Declaration Injection via Style Object Values in JSX SSR

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into t...

CVE-2024-55279

Uguu versions 1.8.9 and earlier are vulnerable to Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. Specifically, the software allows the execution of JavaScript within XML files , which could lead to unauthorized script execution. As a workaround,...

The vulnerability of the digital signature and XML encryption library for Node.js’ xml-crypto, related to improper verification of cryptographic signatures, allows attackers to forge digital signatures.

The vulnerability of the digital signature and encryption library for Node.js’ xml-crypto is related to improper validation of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to forge digital signatures by inserting a newly created, specially crafted signature...

Prestashop SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in Prestashop aioptimizedcombinations versions prior ...

OPENSUSE-SU-2020:0233-1 Security update for chromium, re2

This update for chromium, re2 fixes the following issues: - Update to 80.0.3987.87 boo1162833: CVE-2020-6381: Integer overflow in JavaScript CVE-2020-6382: Type Confusion in JavaScript CVE-2019-18197: Multiple vulnerabilities in XML CVE-2019-19926: Inappropriate implementation in SQLite...

CVE-2017-8498: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft Edge in Windows 10 1607 and 1703, and Windows Server 2016 allows an attacker to read data not intended to be disclosed when Edge allows JavaScript XML DOM objects to detect installed browser extensions, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique fro...