CVE-2026-65899

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...

Improper Trusted Types Policy Reuse

DOMPurify is vulnerable to improper trusted types policy reuse. The vulnerability is due to the reuse of a previously supplied TRUSTEDTYPESPOLICY after clearConfig is called, which allows an attacker to obtain a TrustedHTML object generated under an unintended policy when RETURNTRUSTEDTYPE is...

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

Impact A DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied TRUSTEDTYPESPOLICY even after clearConfig is called. A later caller that requests RETURNTRUSTEDTYPE receives a TrustedHTML object created by the old policy, not by a clean default...

PT-2026-63985

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.4.8 Description The software fails to reset the retained Trusted Types policy when the clearConfig function is called. Consequently, a DOMPurify instance reused across trust boundaries remains bound to a...

CVE-2025-65828

An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy BLE to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from...

EUVD-2025-202617

An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy BLE to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from...

CVE-2025-65828

An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy BLE to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from...

CVE-2025-65828

An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy BLE to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from...

PT-2025-50503

Name of the Vulnerable Software and Affected Versions Meatmeet affected versions not specified Description An attacker within Bluetooth Low Energy BLE range can send commands to Meatmeet devices, leading to a Denial of Service. Specifically, the attacker can issue shutdown, restart, or clear conf...

CVE-2025-65828

An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy BLE to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from...

http2MaxRxResetFramesPerMin of nshttp_default_internal_apps can be set 0 on 13.0 Build 92.21.

http2MaxRxResetFramesPerMin can be set 0 on 13.0 Build 92.21 in the following situation. - HA pair's Secondary. - Running clear config. nshttpdefaultinternalapps is not binded as default and also not enabled HTTP2 option, so it's very unlikely to be affected...