dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...

dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

xsslab

XSS Educational Learning Lab 🛡️ An interactive, educational w...

EUVD-2026-62710

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

PT-2026-78653

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

ANT-2026-REDYDMAE · supabase/supabase · xss

xss medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-REDYDMAE: DOM-based XSS via javascript: scheme in URL hostname check The isVercelUrl helper checks only that ne...

CVE-2026-66621: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2...

SUSE CVE-2026-48552

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browse...

CVE-2026-40126

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

CVE-2026-40126

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

CVE-2026-40126 DOM-based Cross-Site Scripting in OutSystems Service Center

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

EUVD-2026-60159

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

CVE-2026-40126 DOM-based Cross-Site Scripting in OutSystems Service Center

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

CVE-2026-40126

OutSystems Service Center is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low-privileged attacker can exploit it by uploading a file whose filename contains malicious JavaScript code . The flaw exists in all locations within Service Center where a file can be attached and p...

CVE-2026-65913

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

CVE-2026-40126: Improper Neutralization of Input During Web Page Generation

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

CVE-2026-73295

A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting XSS vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution...

SUSE CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...

dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...