Xmldom
15 CVEs tracked since 2026. Since Sep 2026, none of them reached CISA KEV.
Xmldom CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2026-09 | 15 | 0 |
Products
The products that kept showing up in Xmldom's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Xmldom.
- CVE-2026-83619xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser—
- CVE-2026-83618xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator—
- CVE-2026-83617xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator—
- CVE-2026-83616xmldom: Processing Instruction Target Injection Bypasses requireWellFormed—
- CVE-2026-83615xmldom: Quadratic-memory consumption—
- CVE-2026-83614xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge—
- CVE-2026-83613xmldom: Quadratic-time attribute deduplication—
- CVE-2026-83612xmldom: HTML raw-text closing-tag case mismatch causes output amplification—
- CVE-2026-83611xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content—
- CVE-2026-83610xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization—
- CVE-2026-83609xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path—
- CVE-2026-83608xmldom: DocType `name` Injection Bypasses requireWellFormed—
- CVE-2026-83607xmldom: Element name injection via createElement() bypasses requireWellFormed—
- CVE-2026-83606xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions—
- CVE-2026-83605xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed—
The record
- Peak rank
- #80 in Sep 2026
- Busiest month shown
- Sep 2026, 15 CVEs
- Months with a KEV entry
- 0 since Sep 2026
- Monthly snapshots
- 1 since 2026