Cure53 vulnerabilities
32 CVEs and advisories name Cure53 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116804DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content
- CVE-2026-116803DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees
- CVE-2026-116802DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
- CVE-2026-109345DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
- CVE-2026-109344DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
- CVE-2026-75838DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook
- CVE-2026-66010DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING
- CVE-2026-65914DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization
- CVE-2026-65913DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
- CVE-2026-65912DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR
- CVE-2026-65911DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage
- CVE-2026-65904DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode
- CVE-2026-65903DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
- CVE-2026-65902DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
- CVE-2026-65901DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
- CVE-2026-65900DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
- CVE-2026-65899DOMPurify before 3.4.9 Trusted Types Policy State Contamination
- CVE-2026-65898DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig
- CVE-2026-49978DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
- CVE-2026-49459DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- CVE-2026-49458DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- CVE-2026-47423DOMPurify XSS via `selectedcontent` re-clone
- CVE-2026-41240DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
- CVE-2026-41239DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
- CVE-2026-41238DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
- CVE-2026-0540DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML
- CVE-2025-15599DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML
- CVE-2025-48050In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory.
- CVE-2025-26791DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
- CVE-2024-48910DOMPurify vulnerable to tampering by prototype polution