Linux Distros Unpatched Vulnerability : CVE-2026-65898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently...

CVE-2026-65898 DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...

Improper Initialization

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Initialization in the DOMPurify.setConfig API when an uponSanitizeAttribute hook is registered that mutates allowedAttributes. An attacker can caus...

PT-2026-63984

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.11 Description An issue exists where the software fails to clone the ALLOWED ATTR allowlist when setConfig is used with an uponSanitizeAttribute hook. This allows the hook to permanently mutate the shared...

EUVD-2026-33337

OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scop...