CVE-2026-83614

xmldom , a pure JavaScript XML DOM parser, is vulnerable to quadratic-time denial of service via two independent code paths. The first, in lib/sax.js, causes parseElementStartPart to repeatedly rescan a malformed tag name to the next > during single-character recovery, reachable through the de...

CVE-2026-49851 Mistune: Potential DoS via quadratic-time parsing in parse_link_text

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear approximately On² behavior in parselinktext. When parsing Markdown containing many consecutive characters, parselinktext repeatedly scans the input usin...