PT-2026-126508

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 115.44 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists within the DOM: Core and HTM...

PT-2026-126515

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists within the DOM: Core and HTML components. A use-after-free occurs...

PT-2026-126523

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists within the DOM: Core and HTML component. A use-after-free occurs...

PT-2026-126524

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 115.44 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists in the DOM: CSS Object Model...

PT-2026-126526

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 115.44 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists within the DOM: Core and HTM...

PT-2026-126532

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 115.44 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists within the DOM: Core and HTM...

PT-2026-126543

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A spoofing issue exists within the DOM: Core & HTML component. Recommendations Update Firefox t...

PT-2026-126551

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 115.44 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists within the DOM: Core and HTM...

PT-2026-126581

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A mitigation bypass exists in the DOM: Push Subscriptions component. Recommendations Update...

PT-2026-126518

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 159 Firefox ESR versions prior to 115.44 Firefox ESR versions prior to 153.6 Thunderbird versions prior to 159 Thunderbird versions prior to 153.6 Description A use-after-free issue exists in the DOM: Bindings WebIDL...

CVE-2026-116803

DOMPurify versions prior to 3.4.17 are vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability. The root cause is that the library fails to neutralize event handlers in detached subtrees when an IN_PLACE hook removes a parent or sibling node. Consequently, handlers (such as img onerror...

CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

Chromium CVE-2026-110913: Memory corruption in DOM

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-112865

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-112865 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-112865 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-112865

The WProyal Royal Elementor Addons (royal-elementor-addons) plugin for WordPress is vulnerable to a DOM-Based Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 1.7.1069 . Exploitation details an...

EUVD-2026-109714

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...