CVE-2026-73767

Authenticated command injection vulnerabilities exist in the command line interface (CLI) of HPE AOS-CX (ArubaOS-CX). Successful exploitation allows an attacker with authenticated access to execute arbitrary commands as a privileged user on the underlying operating system. The CNA-assigned CVSS 3...

CVE-2026-73754 Authenticated Denial-of-Service Vulnerabilities in the Command Line Interface of AOS-CX

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a vulnerable system...

CVE-2026-73754

CVE-2026-73754 affects the command line interface of HPE AOS-CX (ArubaOS CX). The vulnerability allows an authenticated user with low privileges to trigger a denial-of-service , disrupting normal system operation. The CVSS 3.1 score is 5.3 (Medium) , reflecting a network attack vector with high c...

CVE-2026-73754 Authenticated Denial-of-Service Vulnerabilities in the Command Line Interface of AOS-CX

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a vulnerable system...

EUVD-2026-69618

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a vulnerable system...

EUVD-2026-69617

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

Security Bulletin: IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [CVE-2026-17470, CVE-2026-17469]

Summary IBM i is vulnerable to denial of service due to a buffer overflow and off-by-one write CVE-2026-17470, CVE-2026-17469 in Line Printer Daemon LPD as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17470 DESCRIPTION: IBM i could allow a remote attacker t...

XML Injection

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection vi...

XML Injection

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection vi...

XML Injection

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection in...

CVE-2026-83618

A flaw was found in xmldom, a JavaScript XML parser and serializer module. A remote attacker could bypass the requireWellFormed strict-serialization mitigation for DocumentType injection by embedding line terminators within the publicId or systemId of a DocumentType declaration. This allows for t...

DEBIAN-CVE-2026-83609

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83618 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

CVE-2026-83618 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

CVE-2026-83618

xmldom is a pure JavaScript W3C DOMParser/XMLSerializer module. In versions 0.9.10 through 0.9.12 , the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId using regexes (PubidLiteral_match, SystemLiteral_match) that inherit the multiline flag . A valid li...

CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83611

xmldom (and @xmldom/xmldom ) is a pure JavaScript XML DOM parser. The vulnerability lies in DOMParser.parseFromString() , which can silently accept a malformed end tag where the tag name is followed by a line break and trailing content (e.g., ), closing the element and discarding the trailing con...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...