Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,765All CVEsplus 19,141 rejected
- 674Last 24 hours3,065 in the last 7 days
- 17,166Last 30 days1,611 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 25 | 1 | 0 | 27 | 32 |
| 2025 | 0 | 1 | 1 | 0 | 0 | 2 | 5 |
| 2024 | 2 | 1 | 0 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-116804 | DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Contentcure53 · DOMPurify | Medium5.1 |
| CVE-2026-116803 | DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtreescure53 · DOMPurify | Medium5.1 |
| CVE-2026-116802 | DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Modecure53 · DOMPurify | Medium5.1 |
| CVE-2026-109345 | DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Rootcure53 · DOMPurify | Medium5.1 |
| CVE-2026-109344 | DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hookscure53 · DOMPurify | Medium5.1 |
| CVE-2026-75838 | DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hookcure53 · DOMPurify | Medium5.1 |
| CVE-2026-66010 | DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLINGcure53 · DOMPurify | Medium5.1 |
| CVE-2026-65914 | DOMPurify before 3.3.2 Mutation XSS via Re-Contextualizationcure53 · DOMPurify | Medium5.3 |
| CVE-2026-65913 | DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILEScure53 · DOMPurify | Medium5.1 |
| CVE-2026-65912 | DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTRcure53 · DOMPurify | Medium5.1 |
| CVE-2026-65911 | DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakagecure53 · DOMPurify | Medium5.1 |
| CVE-2026-65904 | DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE modecure53 · DOMPurify | Low2.3 |
| CVE-2026-65903 | DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGScure53 · DOMPurify | Medium5.1 |
| CVE-2026-65902 | DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTagscure53 · DOMPurify | Medium5.3 |
| CVE-2026-65901 | DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeNamecure53 · DOMPurify | Medium5.1 |
| CVE-2026-65900 | DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOMcure53 · DOMPurify | Medium5.1 |
| CVE-2026-65899 | DOMPurify before 3.4.9 Trusted Types Policy State Contaminationcure53 · DOMPurify | Medium5.1 |
| CVE-2026-65898 | DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfigcure53 · DOMPurify | Medium5.1 |
| CVE-2026-49978 | DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentcure53 · DOMPurify | Medium6.3 |
| CVE-2026-49459 | DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMcure53 · DOMPurify | Medium6.1 |
| CVE-2026-49458 | DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checkscure53 · DOMPurify | Medium6.1 |
| CVE-2026-47423 | DOMPurify XSS via `selectedcontent` re-clonecure53 · DOMPurify | High8.2 |
| CVE-2026-41240 | DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)cure53 · DOMPurify | Medium6.0 |
| CVE-2026-41239 | DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modecure53 · DOMPurify | Medium6.8 |
| CVE-2026-41238 | DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallbackcure53 · DOMPurify | Medium6.9 |
| CVE-2026-0540 | DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XMLcure53 · DOMPurify | Medium5.3 |
| CVE-2025-15599 | DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XMLcure53 · DOMPurify | Medium5.1 |
| CVE-2025-48050 | In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier…Cure53 · DOMPurify | High7.5 |
| CVE-2025-26791 | DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).Cure53 · DOMPurify | Medium4.5 |
| CVE-2024-48910 | DOMPurify vulnerable to tampering by prototype polutioncure53 · DOMPurify | Critical9.1 |
| CVE-2024-47875 | DOMPurify nesting-based mXSScure53 · DOMPurify | Critical10.0 |
| CVE-2024-45801 | Tampering by prototype polution in DOMPurifycure53 · DOMPurify | High7.3 |