Security Bulletin: dompurify-3.4.12.tgz (Publicly disclosed vulnerability found by Scanner)

Summary DOMPurify before 3.4.13 has an XSS vulnerability in INPLACE sanitization — element-removal hooks fail to neutralize detached subtrees, allowing event handlers on descendant elements to execute after sanitization completes. CVSS: 5.1 Medium, CWE-79. Vulnerability Details...

Security Bulletin: Vulnerability in DOMPurify affects DB2 Dev Extension (CVE-2026-0540, CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)

Summary Upgraded dompurify to 3.4.0 to remediate CVE-2026-0540, CVE-2026-41238, CVE-2026-41239, and CVE-2026-41240 CWE-79: Cross-site Scripting — highest CVSS Base Score 6.9 Medium — PVR0810799. Vulnerability Details CVEID:CVE-2026-0540 DESCRIPTION: DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through...

Security Bulletin: Vulnerability in DOMPurify affects DB2 Dev Extension (CVE-2026-49458, CVE-2026-49459, CVE-2026-49978)

Summary Upgraded dompurify to 3.4.7 to remediate CVE-2026-49458, CVE-2026-49459, and CVE-2026-49978 CWE-79: Cross-site Scripting via INPLACE sanitization bypasses — highest CVSS Base Score 6.3 Medium — PVR0817403. Vulnerability Details CVEID:CVE-2026-49458 DESCRIPTION: DOMPurify is a DOM-only...

Important: Red Hat Security Advisory: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4

Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: Red Hat Security Advisory: Kiali 2.22.10 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.10 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CLSA-2026-1789404783 TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.8-tuxcare.4...

CLSA-2026-1789400953 TuxCare security update for dompurify (4 CVEs)

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.2.7-tuxcare.3...

CLSA-2026-1789155876 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.8-tuxcare.7...

CLSA-2026-1789155659 TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.3-tuxcare.8...

CLSA-2026-1789155227 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.9-tuxcare.7...

CLSA-2026-1789154458 TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 2.4.7-tuxcare.5...

CLSA-2026-1789154068 TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.0.3-tuxcare.5...

CLSA-2026-1789153936 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.0-tuxcare.5...

CLSA-2026-1789152222 TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.3.0-tuxcare.5...

CLSA-2026-1789146735 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.2.3-tuxcare.4...

CLSA-2026-1789146579 TuxCare security update for dompurify (1 CVE)

TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.8...

CLSA-2026-1789139223 TuxCare security update for dompurify (3 CVEs)

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.2.7-tuxcare.2...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...