EUVD-2026-69302

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-83610

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. The Document.createEntityReference function incorrectly accepts invalid names, which are then directly emitted during serialization. This vulnerability allows an attacker to inject arbitrary XML fragments when an...

CVE-2026-83608

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. A remote attacker can exploit this vulnerability by providing a specially crafted DocumentType.name containing characters like or whitespace. This bypasses the requireWellFormed validation, allowing the injection of...

CVE-2026-83605

A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into...

CVE-2026-79682

Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

EUVD-2026-69299

Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-79682

Dell PowerStore is affected by a Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) with a local attack vector, low complexity, and changed scope, resulting in high impact ...

CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

AZL-99369 CVE-2026-84233 affecting package rpm 4.18.2-2

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

DEBIAN-CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-84111

A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxfdumptable.php. This manipulation of the argument gblOrgID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor...

DEBIAN-CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

DEBIAN-CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

DEBIAN-CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

AZL-99351 CVE-2026-83616 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

DEBIAN-CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...