GHSA-37F3-6P89-6QR9 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Summary The regexreplace filter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, authenticated page editors can supply a catastrophically backtracking PCRE pattern, causing unbounded CPU...

Security Bulletin: Vulnerability in AngularJS affects IBM License Key Server Administration and Reporting Tool

Summary Potential vulnerability in AngularJS has been identified that affects IBM License Key Server Administration and Reporting Tool. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-0716 DESCRIPTION: Improper sanitization ...

GHSA-6XFF-CPCQ-VPW2 vulnerabilities

Vulnerabilities for packages: grafana...

Regular Expression Denial of Service (ReDoS)

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Regular Expressi...

CVE-2026-83606

A flaw was found in xmldom, a JavaScript XML DOM parser. This vulnerability, a Regular Expression Denial of Service ReDoS, occurs due to inefficient processing of unterminated processing instructions in XML input. A remote, unauthenticated attacker can send a specially crafted XML input, causing...

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

DEBIAN-CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

AZL-99336 CVE-2026-83619 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619

xmldom (a pure JavaScript W3C-compliant DOMParser and XMLSerializer module) is vulnerable to a ReDoS (Regular Expression Denial of Service) in versions 0.7.0 through 0.8.15 . The root cause is an unanchored global regex /[ \t\n\r]+$/g in lib/sax.js that trims end-tag names; when an end tag contai...

CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

Regular Expression Denial of Service (ReDoS)

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Regular Expressi...

CVE-2026-83606

@xmldom/xmldom (a pure-JavaScript DOMParser/XMLSerializer module) is affected by a Regular Expression Denial of Service (ReDoS) in its processing-instruction grammar between versions 0.9.0-beta.9 and 0.9.11 . The root cause is a quadratic backtracking pattern in lib/grammar.js, where a greedy S+ ...

CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-83606

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-55520

A flaw was found in Protego, a pure-Python robots.txt parser. A remote attacker could exploit this vulnerability by providing a crafted robots.txt file containing numerous asterisks in Allow or Disallow directives. This causes exponential backtracking during URL wildcard matching, leading to a...