# cve.now: Cure53

The newest entries naming Cure53 as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116804](https://cve.now/CVE-2026-116804.md): DOMPurify from 3.4.4 before 3.4.17 SAFE\_FOR\_TEMPLATES Bypass via Shadow Root Content (CVSS 5.1)
- [CVE-2026-116803](https://cve.now/CVE-2026-116803.md): DOMPurify before 3.4.17 DOM XSS via IN\_PLACE Hook-Detached Subtrees (CVSS 5.1)
- [CVE-2026-116802](https://cve.now/CVE-2026-116802.md): DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode (CVSS 5.1)
- [CVE-2026-109345](https://cve.now/CVE-2026-109345.md): DOMPurify before 3.4.16 XSS via IN\_PLACE Returned Rawtext Root (CVSS 5.1)
- [CVE-2026-109344](https://cve.now/CVE-2026-109344.md): DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN\_PLACE afterSanitize Hooks (CVSS 5.1)
- [CVE-2026-75838](https://cve.now/CVE-2026-75838.md): DOMPurify before 3.4.13 Cross-Site Scripting via IN\_PLACE hook (CVSS 5.1)
- [CVE-2026-66010](https://cve.now/CVE-2026-66010.md): DOMPurify before 3.4.12 Hook Bypass via CUSTOM\_ELEMENT\_HANDLING (CVSS 5.1)
- [CVE-2026-65914](https://cve.now/CVE-2026-65914.md): DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization (CVSS 5.3)
- [CVE-2026-65913](https://cve.now/CVE-2026-65913.md): DOMPurify before 3.3.2 Prototype Pollution via USE\_PROFILES (CVSS 5.1)
- [CVE-2026-65912](https://cve.now/CVE-2026-65912.md): DOMPurify before 3.3.2 URI Validation Bypass via ADD\_ATTR (CVSS 5.1)
- [CVE-2026-65911](https://cve.now/CVE-2026-65911.md): DOMPurify before 3.4.0 XSS via ADD\_ATTR/ADD\_TAGS State Leakage (CVSS 5.1)
- [CVE-2026-65904](https://cve.now/CVE-2026-65904.md): DOMPurify through 3.3.3 Cross-Site Scripting via IN\_PLACE mode (CVSS 2.3)
- [CVE-2026-65903](https://cve.now/CVE-2026-65903.md): DOMPurify before 3.4.0 ADD\_TAGS Function Bypasses FORBID\_TAGS (CVSS 5.1)
- [CVE-2026-65902](https://cve.now/CVE-2026-65902.md): DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags (CVSS 5.3)
- [CVE-2026-65901](https://cve.now/CVE-2026-65901.md): DOMPurify 3.4.6 Cross-Site Scripting via IN\_PLACE nodeName (CVSS 5.1)
- [CVE-2026-65900](https://cve.now/CVE-2026-65900.md): DOMPurify before 3.4.8 Template Expression Injection via RETURN\_DOM (CVSS 5.1)
- [CVE-2026-65899](https://cve.now/CVE-2026-65899.md): DOMPurify before 3.4.9 Trusted Types Policy State Contamination (CVSS 5.1)
- [CVE-2026-65898](https://cve.now/CVE-2026-65898.md): DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig (CVSS 5.1)
- [CVE-2026-49978](https://cve.now/CVE-2026-49978.md): DOMPurify IN\_PLACE Sanitization Bypass via Attached Shadow Root Inside \<template\>.content (CVSS 6.3)
- [CVE-2026-49459](https://cve.now/CVE-2026-49459.md): DOMPurify: IN\_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM (CVSS 6.1)
- [CVE-2026-49458](https://cve.now/CVE-2026-49458.md): DOMPurify: Cross-realm IN\_PLACE sanitization leaves executable markup intact via realm-bound \`instanceof\` checks (CVSS 6.1)
- [CVE-2026-47423](https://cve.now/CVE-2026-47423.md): DOMPurify XSS via \`selectedcontent\` re-clone (CVSS 8.2)
- [CVE-2026-41240](https://cve.now/CVE-2026-41240.md): DOMPurify: FORBID\_TAGS bypassed by function-based ADD\_TAGS predicate (asymmetry with FORBID\_ATTR fix) (CVSS 6.0)
- [CVE-2026-41239](https://cve.now/CVE-2026-41239.md): DOMPurify has a SAFE\_FOR\_TEMPLATES bypass in RETURN\_DOM mode (CVSS 6.8)
- [CVE-2026-41238](https://cve.now/CVE-2026-41238.md): DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM\_ELEMENT\_HANDLING Fallback (CVSS 6.9)
- [CVE-2026-0540](https://cve.now/CVE-2026-0540.md): DOMPurify XSS via Missing Rawtext Elements in SAFE\_FOR\_XML (CVSS 5.3)
- [CVE-2025-15599](https://cve.now/CVE-2025-15599.md): DOMPurify XSS via Textarea Rawtext Bypass in SAFE\_FOR\_XML (CVSS 5.1)
- [CVE-2025-48050](https://cve.now/CVE-2025-48050.md): In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. (CVSS 7.5)
- [CVE-2025-26791](https://cve.now/CVE-2025-26791.md): DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS). (CVSS 4.5)
- [CVE-2024-48910](https://cve.now/CVE-2024-48910.md): DOMPurify vulnerable to tampering by prototype polution (CVSS 9.1)
- [CVE-2024-47875](https://cve.now/CVE-2024-47875.md): DOMPurify nesting-based mXSS (CVSS 10.0)
- [CVE-2024-45801](https://cve.now/CVE-2024-45801.md): Tampering by prototype polution in DOMPurify (CVSS 7.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cure53
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.