Known vulnerabilities in DOMPurify - page 2

Vendor: Cure53
Software: DOMPurify
Software CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
Total vulnerabilities: 36
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting DOMPurify DOMPurify is affected by 36 known vulnerabilities: 1 high, 21 medium, 14 low Critical High Medium Low

Vulnerabilities (36)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU126317 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
3.3.2 16.04.2026 SB20260325102
#VU124499 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-3126
CWE-79 Low
No
No
3.3.2 25.03.2026 SB20260325102
#VU114312 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-48050
CWE-22 High
No
No
- 20.08.2025 SB20250820123
SB20250820124
SB20250820125
and 15 more
#VU105783 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-26791
CWE-79 Low
No
No
3.2.4 17.03.2025 SB2025031740
SB2025031741
SB2025031771
and 35 more
#VU99556 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-48910
CWE-1321 Medium
No
No
2.4.2 31.10.2024 SB2024103154
SB2024111356
SB2024112007
and 15 more
#VU99261 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47875
CWE-79 Medium
No
No
2.5.0, 3.1.3 22.10.2024 SB20241022382
SB20241022383
SB20241022392
and 27 more
#VU97758 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2024-45801
CWE-1321 Medium
No
No
2.5.4, 3.1.3 27.09.2024 SB2024092751
SB2024100823
SB2024100827
and 32 more
#VU89377 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.3 13.05.2024 SB2024051323
#VU89126 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.2, 3.1.2 03.05.2024 SB2024050313
#VU89125 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.2, 3.1.2 03.05.2024 SB2024050313
#VU89051 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.5.1, 3.1.1 29.04.2024 SB2024042940
#VU49096 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.0.17 19.12.2020 SB2020121918
#VU48814 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.2.3 07.12.2020 SB2020120724
#VU49403 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-26870
CWE-79 Medium
No
No
2.0.17 07.10.2020 SB2021011214
SB2021072052
SB2020100725
and 4 more
#VU23938 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.0.3 06.01.2020 SB2019100407
#VU22273 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-16728
CWE-79 Low
No
No
2.0.7 24.10.2019 SB2019102414
SB2023033138
SB2024020623


Showing elements 21 - 40 out of 36