EUVD-2026-48277

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...

CVE-2026-65914 DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...

CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

CVE-2026-65902

DOMPurify 3.4.7 fixes a mutation pollution vulnerability. Affected: DOMPurify

CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

CVE-2026-65902

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

CVE-2026-65898 DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...

CVE-2026-65914: Improper Neutralization of Input During Web Page Generation

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...

CVE-2026-65902: Trust Boundary Violation

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

CVE-2026-47671

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

protobufjs: Text Format string map parsing can mutate returned map object prototype

Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry. This affected the optional Text Format...

CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-32823 dataCycle State-Changing GET Endpoints Enable CSRF

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

PT-2026-61629

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

EUVD-2026-45875

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...

CVE-2026-45138 CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...

CVE-2026-63990

In CVE-2026-63990, the Linux kernel bonding code incorrectly allowed enslaving CAN devices (including vxcan) to a bonding master, which mutated CAN private state (can_ml_priv) rather than Ethernet-like structures. This caused a kernel paging request crash in can_rx_unregister() and potential memo...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the LocalDocumentType and LocalProperty schema-mutator methods. An attacker can mutate their database schema by sending DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY requests with an authenticated identity that...