CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609

xmldom (a pure JavaScript W3C XML DOM module) is vulnerable in versions 0.9.0 through 0.9.12 due to a flaw in lib/grammar.js. The shared reg() builder compiles the anchored QName_exact validator with the multiline flag , causing ^ and $ to validate only one line rather than the full name. As a re...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83608 xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENTTYPENODE branch in lib/dom.js validates publicId, systemId, and internalSubset under...

CVE-2026-83608

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENTTYPENODE branch in lib/dom.js validates publicId, systemId, and internalSubset under...

CVE-2026-83608 xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENTTYPENODE branch in lib/dom.js validates publicId, systemId, and internalSubset under...

CVE-2026-83608

xmldom (a pure JavaScript XML DOM module) is vulnerable to a DocType name injection that bypasses the requireWellFormed strict mode. The DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim; a name containing > or whitesp...

EUVD-2026-69218

Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information...

CVE-2026-79685

Dell PowerStore is affected by an Argument Injection vulnerability. An authenticated user with limited privileges could exploit this to gain unauthorized access to sensitive system information , resulting in a High confidentiality impact with no integrity or availability impact (CVSS v3.1: 6.5 ME...

CVE-2026-79685

Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information...

CVE-2026-83607

xmldom , a pure JavaScript XML DOM module, is affected by an element name injection vulnerability. Prior to @xmldom/xmldom 0.8.14 and 0.9.11 , and in xmldom 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name that XMLSerializer.serializeToString() emits verbatim....

CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-83605

xmldom is a pure JavaScript W3C DOM Level 2 Core module. The vulnerability lies in Element.setAttribute() , which invokes the private _createAttribute(name) path without validating the attribute name against QName , unlike Document.createAttribute(). Because XMLSerializer.serializeToString() emit...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-84109

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Executing a manipulation of the argument highorder can lead to sql injection. The attack can be launched remotely. The exploit has been made...

CVE-2026-58571

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...