CVE-2017-9822

CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution RCE DotNetNuke DNN versions between 5.0.0 - 9.3.0 are affected to deserialization vulnerability that leads to Remote Code Execution RCE. DotNetNuke uses the DNNPersonalization cookie to store anonymous users’ personalization...

cve-2017-9822

CVE-2017-9822 Key Information Setup Environment Setup Debug Analysis Debug XmlSerializer Attack Gadget ObjectDataProvider ResourceDictionary From XML Insecure Deserialization to RCE CVE-2017-9822 DNN also known as DotNetNuke before version 9.1.1 has the ability to execute remote code via cookies,...

CLEANSTART-2026-FD05711 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-NW59337 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-IC19536 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-UU21916 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-TN18132 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-RE03719 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module

Security vulnerability affects the n8n package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in xmldom

Summary Multiple vulnerabilities were addressed in IBM DataPower Gateway version 11.0.0.3 Vulnerability Details CVEID:CVE-2026-83605 DESCRIPTION: xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and...

EUVD-2026-69239

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed...

xmldom: Element name injection via createElement() bypasses requireWellFormed

Summary Document.createElement in @xmldom/xmldom accepts arbitrary strings as the tagName parameter with zero validation. The serializer emits the tag name verbatim into XML/HTML output. Critically, the requireWellFormed: true serializer option — the recommended mitigation from CVE-2026-41672,...

EUVD-2026-69215

xmldom: Attribute name injection via setAttribute bypasses requireWellFormed...

EUVD-2026-69222

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization...

SUSE CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

DEBIAN-CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

DEBIAN-CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

DEBIAN-CVE-2026-83607

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

AZL-99347 CVE-2026-83605 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...