EUVD-2026-51478

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

EUVD-2026-48268

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTEDTYPESPOLICY. A later caller that requests RETURNTRUSTEDTYPE output receives a TrustedHTML...

GHSA-VXR8-FQ34-VVX9 DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

Impact A DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied TRUSTEDTYPESPOLICY even after clearConfig is called. A later caller that requests RETURNTRUSTEDTYPE receives a TrustedHTML object created by the old policy, not by a clean default...