Known vulnerabilities in DOMPurify

Vendor: Cure53
Software: DOMPurify
Software CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
Total vulnerabilities: 41
Public exploits: 0
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting DOMPurify DOMPurify is affected by 41 known vulnerabilities: 1 high, 26 medium, 14 low Critical High Medium Low

Vulnerabilities (41)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140846 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-75838
CWE-79 Low
No
No
3.4.13 04.08.2026 SB2026080415
SB2026092001
SB2026092002
and 6 more
#VU137374 - Improper Access Control
CVE-2026-66010
CWE-284 Medium
No
No
3.4.12 13.07.2026 SB2026071311
SB2026091499
SB20260914100
and 4 more
#VU135709 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-15599
CWE-79 Low
No
No
3.2.7 29.06.2026 SB2026062919
SB2026062922
#VU135706 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-0540
CWE-79 Medium
No
No
3.3.2 29.06.2026 SB2026062916
SB2026062922
SB2026081810
and 3 more
#VU132186 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-47423
CWE-79 Medium
No
No
3.4.5 23.05.2026 SB2026052306
#VU126561 - Permissive List of Allowed Inputs
CVE-2026-41240
CWE-183 Low
No
No
3.4.0 20.04.2026 SB2026041630
SB2026042938
SB2026060221
and 11 more
#VU126560 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41239
CWE-79 Medium
No
No
3.4.0 20.04.2026 SB2026041630
SB2026042938
SB2026060221
and 7 more
#VU126559 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2026-41238
CWE-1321 Medium
No
No
3.4.0 20.04.2026 SB2026041630
SB2026042938
SB2026060221
and 6 more
#VU126319 - Improper Access Control
CVE-2026-65903
CWE-284 Medium
No
No
3.4.0 16.04.2026 SB2026041630
SB2026091499
SB20260914100
and 1 more
#VU126316 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-65911
CWE-79 Medium
No
No
3.4.0 16.04.2026 SB2026041630
#VU126315 - Improper Check for Unusual or Exceptional Conditions
CVE-2026-65904
CWE-754 Medium
No
No
3.4.0 16.04.2026 SB2026041630
#VU114312 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-48050
CWE-22 High
No
No
- 20.08.2025 SB20250820123
SB20250820124
SB20250820125
and 15 more
#VU105783 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-26791
CWE-79 Low
No
No
3.2.4 17.03.2025 SB2025031740
SB2025031741
SB2025031771
and 35 more
#VU99556 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-48910
CWE-1321 Medium
No
No
2.4.2 31.10.2024 SB2024103154
SB2024111356
SB2024112007
and 15 more
#VU99261 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47875
CWE-79 Medium
No
No
2.5.0, 3.1.3 22.10.2024 SB20241022382
SB20241022383
SB20241022392
and 27 more
#VU97758 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-45801
CWE-1321 Medium
No
No
2.5.4, 3.1.3 27.09.2024 SB2024092751
SB2024100823
SB2024100827
and 32 more
#VU89377 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.3 13.05.2024 SB2024051323
#VU89126 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.2, 3.1.2 03.05.2024 SB2024050313
#VU89125 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.2, 3.1.2 03.05.2024 SB2024050313
#VU89051 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.1, 3.1.1 29.04.2024 SB2024042940


Showing elements 1 - 20 out of 41