Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

1213 matches found

UbuntuCve
UbuntuCve•added 2026/04/23 4:16 p.m.•23 views

CVE-2026-41238

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

6.9CVSS6.2AI score0.00346EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve•added 2026/04/23 4:16 p.m.•21 views

CVE-2026-41240

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

6.1CVSS6.3AI score0.00404EPSS
SaveExploits1References2
OSV
OSV•added 2026/04/23 4:16 p.m.•14 views

UBUNTU-CVE-2026-41238

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

6.9CVSS6.2AI score0.00346EPSS
SaveExploits0References3
OSV
OSV•added 2026/04/23 4:16 p.m.•15 views

UBUNTU-CVE-2026-41240

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

6.1CVSS6.3AI score0.00404EPSS
SaveExploits1References3
OSV
OSV•added 2026/04/23 2:54 p.m.•14 views

CVE-2026-41240 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

6CVSS6.3AI score
SaveExploits0References5
CVE
CVE•added 2026/04/23 2:54 p.m.•180 views

CVE-2026-41240

Summary of technical details (CVE-2026-41240) : DOMPurify prior to 3.4.0 has an inconsistency between FORBID_TAGS and FORBID_ATTR when function-based ADD_TAGS is used. The fix added an early exit for FORBID_ATTR but the FORBID_TAGS path remained unpatched, causing short-circuiting that allows for...

6.1CVSS6.3AI score0.00404EPSS
SaveExploits1References3Affected Software1
Cvelist
Cvelist•added 2026/04/23 2:54 p.m.•49 views

CVE-2026-41240 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

6CVSS0.00404EPSS
SaveExploits1References3
Debian CVE
Debian CVE•added 2026/04/23 2:54 p.m.•19 views

CVE-2026-41240

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

6.1CVSS6.3AI score0.00404EPSS
SaveExploits1
attackerkb
attackerkb•added 2026/04/23 2:54 p.m.•9 views

CVE-2026-41240

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

6CVSS6.3AI score0.00404EPSS
SaveExploits1References4Affected Software1
Vulnrichment
Vulnrichment•added 2026/04/23 2:54 p.m.•10 views

CVE-2026-41240 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

6CVSS6.3AI score0.00404EPSS
SaveExploits1References3
Cvelist
Cvelist•added 2026/04/23 2:47 p.m.•56 views

CVE-2026-41239 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, SAFEFORTEMPLATES strips ... expressions from untrusted HTML. This works in string mode but not with RETURNDOM or RETURNDOMFRAGMENT, allowing XSS via...

6.8CVSS0.00414EPSS
SaveExploits0References2
attackerkb
attackerkb•added 2026/04/23 2:47 p.m.•9 views

CVE-2026-41239

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, SAFEFORTEMPLATES strips ... expressions from untrusted HTML. This works in string mode but not with RETURNDOM or RETURNDOMFRAGMENT, allowing XSS via...

6.8CVSS6.1AI score0.00414EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment•added 2026/04/23 2:47 p.m.•24 views

CVE-2026-41239 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, SAFEFORTEMPLATES strips ... expressions from untrusted HTML. This works in string mode but not with RETURNDOM or RETURNDOMFRAGMENT, allowing XSS via...

6.8CVSS6.1AI score0.00414EPSS
SaveExploits0References2
CVE
CVE•added 2026/04/23 2:47 p.m.•119 views

CVE-2026-41239

CVE-2026-41239 affects DOMPurify. From v1.0.10 up to but not including v3.4.0, SAFE_FOR_TEMPLATES incorrectly strips mustache/templating expressions in untrusted HTML when RETURN_DOM/RETURN_DOM_FRAGMENT are used, enabling XSS in template-evaluating frameworks (e.g., Vue 2). The issue is triggered...

6.8CVSS6.1AI score0.00414EPSS
SaveExploits0References2
OSV
OSV•added 2026/04/23 2:47 p.m.•13 views

CVE-2026-41239 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, SAFEFORTEMPLATES strips ... expressions from untrusted HTML. This works in string mode but not with RETURNDOM or RETURNDOMFRAGMENT, allowing XSS via...

6.8CVSS5.8AI score
SaveExploits0References4
Debian CVE
Debian CVE•added 2026/04/23 2:47 p.m.•22 views

CVE-2026-41239

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, SAFEFORTEMPLATES strips ... expressions from untrusted HTML. This works in string mode but not with RETURNDOM or RETURNDOMFRAGMENT, allowing XSS via...

6.8CVSS6.1AI score0.00414EPSS
SaveExploits0
Cvelist
Cvelist•added 2026/04/23 2:43 p.m.•54 views

CVE-2026-41238 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

6.9CVSS0.00346EPSS
SaveExploits0References2
attackerkb
attackerkb•added 2026/04/23 2:43 p.m.•10 views

CVE-2026-41238

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

6.9CVSS6.2AI score0.00346EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment•added 2026/04/23 2:43 p.m.•8 views

CVE-2026-41238 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

6.9CVSS6.2AI score0.00346EPSS
SaveExploits0References2
OSV
OSV•added 2026/04/23 2:43 p.m.•18 views

CVE-2026-41238 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses DOMPurify.sanitize with the default configuration no CUSTOMELEMENTHANDLING option, a prior prototype...

6.9CVSS5.9AI score
SaveExploits0References4
Rows per page
Query Builder