cure53 records

26 published records for vendor cure53.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

26 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2024-48910Proof of concept	DOMPurify vulnerable to tampering by prototype polutioncure53 · dompurify · CWE-1321 Pre-auth XSS Prototype pollution	Critical9.8	—	1.1%	Oct 31, 2024
32Monitor	CVE-2026-47423Proof of concept	DOMPurify XSS via `selectedcontent` re-clonecure53 · dompurify · CWE-79 Pre-auth XSS	High8.2	—	0.4%	Jul 14, 2026
25Monitor	CVE-2020-26870No exploit	Cure53 DOMPurify before 2.0.17 allows mutation XSS.cure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.1	—	4.8%	Oct 7, 2020
25Monitor	CVE-2026-49978No exploit	DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentcure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.3	—	0.4%	Jul 14, 2026
24Monitor	CVE-2019-16728No exploit	DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome acure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.1	—	1.4%	Sep 24, 2019
24Monitor	CVE-2024-47875Proof of concept	DOMPurify nesting-based mXSScure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.1	—	1.1%	Oct 11, 2024
24Monitor	CVE-2024-45801No exploit	Tampering by prototype polution in DOMPurifycure53 · dompurify · CWE-1333 Pre-auth XSS Prototype pollution	Medium6.1	—	0.8%	Sep 16, 2024
24Monitor	CVE-2025-26791No exploit	DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).cure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Feb 14, 2025
24Monitor	CVE-2019-25155No exploit	DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attcure53 · dompurify · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.5%	Nov 6, 2023
24Monitor	CVE-2026-49458No exploit	DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checkscure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Jul 14, 2026
24Monitor	CVE-2026-41240No exploit	DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)cure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.0	—	0.4%	Apr 23, 2026
24Monitor	CVE-2026-49459No exploit	DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMcure53 · dompurify · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Jul 14, 2026
21Monitor	CVE-2026-65902No exploit	DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTagscure53 · dompurify · CWE-501 Pre-auth	Medium5.3	—	0.3%	Jul 23, 2026
21Monitor	CVE-2026-0540No exploit	DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XMLcure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.3	—	0.3%	Mar 3, 2026
21Monitor	CVE-2026-65914No exploit	DOMPurify before 3.3.2 Mutation XSS via Re-Contextualizationcure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.3	—	0.3%	Jul 23, 2026
20Monitor	CVE-2026-65899No exploit	DOMPurify before 3.4.9 Trusted Types Policy State Contaminationcure53 · dompurify · CWE-693 Pre-auth	Medium5.1	—	0.4%	Jul 23, 2026
20Monitor	CVE-2026-65911No exploit	DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakagecure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.1	—	0.3%	Jul 23, 2026
20Monitor	CVE-2026-65903No exploit	DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGScure53 · dompurify · CWE-697 Pre-auth	Medium5.1	—	0.3%	Jul 23, 2026
20Monitor	CVE-2026-65913No exploit	DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILEScure53 · dompurify · CWE-1321 Pre-auth XSS Prototype pollution	Medium5.1	—	0.3%	Jul 23, 2026
20Monitor	CVE-2026-65900No exploit	DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOMcure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.1	—	0.3%	Jul 23, 2026
20Monitor	CVE-2026-65912No exploit	DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTRcure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.1	—	0.3%	Jul 23, 2026
20Monitor	CVE-2026-65901No exploit	DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeNamecure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.1	—	0.2%	Jul 23, 2026
20Monitor	CVE-2025-15599No exploit	DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XMLcure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.1	—	0.2%	Mar 3, 2026
20Monitor	CVE-2026-66010No exploit	DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLINGcure53 · dompurify · CWE-79 Pre-auth XSS	Medium5.1	—	0.2%	Jul 24, 2026
20Monitor	CVE-2026-65898No exploit	DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfigcure53 · dompurify · CWE-79 XSS	Medium5.1	—	0.2%	Jul 23, 2026

CVE-2024-48910
39Monitor
DOMPurify vulnerable to tampering by prototype polution
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- XSS
- Prototype pollution
cure53 · dompurifyOct 31, 2024
CVE-2026-47423
32Monitor
DOMPurify XSS via `selectedcontent` re-clone
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 14, 2026
CVE-2020-26870
25Monitor
Cure53 DOMPurify before 2.0.17 allows mutation XSS.
MediumCVSS 6.1No exploitEPSS 4%
- Pre-auth
- XSS
cure53 · dompurifyOct 7, 2020
CVE-2026-49978
25Monitor
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 14, 2026
CVE-2019-16728
24Monitor
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome a
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
cure53 · dompurifySep 24, 2019
CVE-2024-47875
24Monitor
DOMPurify nesting-based mXSS
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
cure53 · dompurifyOct 11, 2024
CVE-2024-45801
24Monitor
Tampering by prototype polution in DOMPurify
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
- Prototype pollution
cure53 · dompurifySep 16, 2024
CVE-2025-26791
24Monitor
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyFeb 14, 2025
CVE-2019-25155
24Monitor
DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' att
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- Open redirect
cure53 · dompurifyNov 6, 2023
CVE-2026-49458
24Monitor
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 14, 2026
CVE-2026-41240
24Monitor
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
MediumCVSS 6.0No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyApr 23, 2026
CVE-2026-49459
24Monitor
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 14, 2026
CVE-2026-65902
21Monitor
DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
cure53 · dompurifyJul 23, 2026
CVE-2026-0540
21Monitor
DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyMar 3, 2026
CVE-2026-65914
21Monitor
DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 23, 2026
CVE-2026-65899
20Monitor
DOMPurify before 3.4.9 Trusted Types Policy State Contamination
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
cure53 · dompurifyJul 23, 2026
CVE-2026-65911
20Monitor
DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 23, 2026
CVE-2026-65903
20Monitor
DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
cure53 · dompurifyJul 23, 2026
CVE-2026-65913
20Monitor
DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
- XSS
- Prototype pollution
cure53 · dompurifyJul 23, 2026
CVE-2026-65900
20Monitor
DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 23, 2026
CVE-2026-65912
20Monitor
DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 23, 2026
CVE-2026-65901
20Monitor
DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 23, 2026
CVE-2025-15599
20Monitor
DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyMar 3, 2026
CVE-2026-66010
20Monitor
DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING
MediumCVSS 5.1No exploitEPSS 0%
- Pre-auth
- XSS
cure53 · dompurifyJul 24, 2026
CVE-2026-65898
20Monitor
DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig
MediumCVSS 5.1No exploitEPSS 0%
- XSS
cure53 · dompurifyJul 23, 2026