cure53 vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20252
3. 202627

Newest CVEs

• CVE-2026-116804

  DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-116803

  DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-116802

  DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-109345

  DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-109344

  DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-75838

  DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-66010

  DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-65914

  DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

  cure53 · DOMPurify

  Medium5.3
• CVE-2026-65913

  DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

  cure53 · DOMPurify

  Medium5.1
• CVE-2026-65912

  DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

  cure53 · DOMPurify

  Medium5.1