Security Bulletin: IBM Maximo Application Suite uses dompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240.

Summary IBM Maximo Application Suite uses fdompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41238 DESCRIPTION: DOMPurify is a DOM-only...

CVE-2026-41239 vulnerabilities

Vulnerabilities for packages: langfuse-fips, opensearch-dashboards-fips, wazuh-dashboard, wazuh-dashboard-fips, nextcloud-server, opensearch-dashboards...

UBUNTU-CVE-2026-41239

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, SAFEFORTEMPLATES strips ... expressions from untrusted HTML. This works in string mode but not with RETURNDOM or RETURNDOMFRAGMENT, allowing XSS via...