| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-66010 | vulnerable | vulnerable | fixed | fixed | DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook fo ... |
| CVE-2026-65914 | vulnerable | vulnerable | fixed | fixed | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sani ... |
| CVE-2026-65913 | vulnerable | vulnerable | fixed | fixed | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in ... |
| CVE-2026-65912 | vulnerable | vulnerable | fixed | fixed | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability ... |
| CVE-2026-65911 | vulnerable | vulnerable | fixed | fixed | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR ... |
| CVE-2026-65904 | vulnerable | vulnerable | fixed | fixed | DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_P ... |
| CVE-2026-65903 | vulnerable | vulnerable | fixed | fixed | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function ... |
| CVE-2026-65902 | vulnerable | vulnerable | fixed | fixed | DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ... |
| CVE-2026-65901 | vulnerable | vulnerable | fixed | fixed | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability ... |
| CVE-2026-65900 | vulnerable | vulnerable | fixed | fixed | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE ... |
| CVE-2026-65899 | vulnerable | vulnerable | fixed | fixed | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types ... |
| CVE-2026-65898 | vulnerable | vulnerable | fixed | fixed | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ... |
| CVE-2026-49978 | vulnerable | vulnerable | fixed | fixed | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathM ... |
| CVE-2026-49459 | vulnerable | vulnerable | fixed | fixed | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathM ... |
| CVE-2026-49458 | vulnerable | vulnerable | fixed | fixed | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathM ... |
| CVE-2026-47423 | vulnerable | vulnerable | fixed | fixed | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathM ... |
| CVE-2026-41240 | vulnerable | vulnerable | fixed | fixed | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathM ... |
| CVE-2026-41239 | vulnerable | vulnerable | fixed | fixed | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathM ... |
| CVE-2026-41238 | vulnerable | vulnerable | fixed | fixed | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathM ... |
| CVE-2026-0540 | vulnerable | vulnerable | fixed | fixed | DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit ... |
| CVE-2025-26791 | vulnerable (no DSA) | fixed | fixed | fixed | DOMPurify before 3.2.4 has an incorrect template literal regular expre ... |
| CVE-2025-15599 | vulnerable | vulnerable | fixed | fixed | DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross- ... |