Known vulnerabilities in DOMPurify

Vendor: Cure53
Software: DOMPurify
Software CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
Total vulnerabilities: 36
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting DOMPurify DOMPurify is affected by 36 known vulnerabilities: 1 high, 21 medium, 14 low Critical High Medium Low

Vulnerabilities (36)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140846 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.4.13 04.08.2026 SB2026080415
#VU137374 - Improper Access Control
CWE-284 Medium
No
No
3.4.12 13.07.2026 SB2026071311
#VU137373 - Improper Access Control
CWE-284 Low
No
No
3.4.11 13.07.2026 SB2026071310
#VU137372 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
3.4.8 13.07.2026 SB2026071309
#VU135709 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-15599
CWE-79 Low
No
No
3.2.7 29.06.2026 SB2026062919
SB2026062922
#VU135706 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-0540
CWE-79 Medium
No
No
3.3.2 29.06.2026 SB2026062916
SB2026062922
SB2026081810
and 2 more
#VU134420 - Protection Mechanism Failure
CWE-693 Medium
No
No
3.4.9 12.06.2026 SB2026061217
#VU132386 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-49978
CWE-79 Medium
No
No
3.4.7 27.05.2026 SB2026052785
SB20260731138
SB2026083170
#VU132385 - Improper input validation
CWE-20 Medium
No
No
3.4.7 27.05.2026 SB2026052785
#VU132356 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-49459
CWE-79 Medium
No
No
3.4.6 27.05.2026 SB2026052729
#VU132355 - Improper input validation
CVE-2026-49458
CWE-20 Medium
No
No
3.4.6 27.05.2026 SB2026052729
#VU132354 - Trust Boundary Violation
CWE-501 Medium
No
No
3.4.6 27.05.2026 SB2026052729
#VU132186 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-47423
CWE-79 Medium
No
No
3.4.5 23.05.2026 SB2026052306
#VU126561 - Permissive List of Allowed Inputs
CVE-2026-41240
CWE-183 Low
No
No
3.4.0 20.04.2026 SB2026041630
SB2026042938
SB2026060221
and 9 more
#VU126560 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41239
CWE-79 Medium
No
No
3.4.0 20.04.2026 SB2026041630
SB2026042938
SB2026060221
and 5 more
#VU126559 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-41238
CWE-1321 Medium
No
No
3.4.0 20.04.2026 SB2026041630
SB2026042938
SB2026060221
and 4 more
#VU126319 - Improper Access Control
CWE-284 Medium
No
No
3.4.0 16.04.2026 SB2026041630
#VU126318 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CWE-1321 Medium
No
No
3.3.2 16.04.2026 SB20260325102
#VU126316 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
3.4.0 16.04.2026 SB2026041630
#VU126315 - Improper Check for Unusual or Exceptional Conditions
CWE-754 Medium
No
No
3.4.0 16.04.2026 SB2026041630


Showing elements 1 - 20 out of 36