X
Vendor security profile
xmldom
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs19
Critical0
CISA KEV0
Public exploit10
Patch rate%32
Avg. CVSS8.5
12-month vulnerability rate
0
0
0
0
0
0
4
0
0
0
15
0
CVE KEV
CVE severity distribution
19toplam CVE
High17 (89%)
Medium2 (11%)
Patch and exploitation view
%32
Verified patch
%0
CISA KEV
%53
Public exploit
6Patch available
0Partial
8Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
8.7
CVE-2026-83619
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
X
Patch verifiedEPSS %1
8.7
CVE-2026-83618
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
X
Patch verifiedEPSS %1
8.7
CVE-2026-83617
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
X
Patch verifiedEPSS %1
8.7
CVE-2026-83616
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
X
WorkaroundEPSS %1
8.7
CVE-2026-83615
xmldom: Quadratic-memory consumption
X
WorkaroundEPSS %1
8.7
CVE-2026-83614
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
X
WorkaroundEPSS %1
8.7
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication
X
WorkaroundEPSS %1
8.7
CVE-2026-83612
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
X
Patch verifiedEPSS %1
6.9
CVE-2026-83611
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
X
WorkaroundEPSS %1
6.3
CVE-2026-83610
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
X
Patch status unknownEPSS %1