Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 09.10.2026

CVE-2026-108260

@tinacms/web-components: `tina-markdown` escribe URLs de enlaces de texto enriquecido en `href` sin validar el esquema, permitiendo XSS almacenado

Una vulnerabilidad de XSS almacenado en @tinacms/web-components permite a usuarios con permisos de edición ejecutar scripts maliciosos debido a la falta de validación del esquema de URL en enlaces de texto enriquecido.

npm

@tinacms/web-components

Baja 05.10.2026

CVE-2026-109345

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

npm

dompurify

Baja 30.09.2026

CVE-2026-109344

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

npm

dompurify

Alta 17.09.2026

CVE-2026-63459

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

npm

@vendure/dashboard

Media 07.08.2026

CVE-2026-75838

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

npm

dompurify

Alta 31.07.2026

CVE-2026-58263

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

npm

jodit

Baja 21.07.2026

CVE-2026-66010

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

npm

dompurify

Baja 19.06.2026

ghsa-h5jc-78hr-3pc9

Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

npm

@sveltia/cms

Media 18.06.2026

CVE-2026-65898

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

npm

dompurify

Baja 15.06.2026

CVE-2026-65899

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

npm

dompurify

Baja 15.06.2026

CVE-2026-65900

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

npm

dompurify

Media 15.06.2026

CVE-2026-49978

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

npm

dompurify

Baja 15.06.2026

CVE-2026-65901

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

npm

dompurify

Media 15.06.2026

CVE-2026-65902

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

npm

dompurify

Media 15.06.2026

CVE-2026-49458

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

npm

dompurify

Media 15.06.2026

CVE-2026-49459

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

npm

dompurify

Alta 01.06.2026

CVE-2026-47423

DOMPurify XSS via selectedcontent re-clone

npm

dompurify

Alta 26.05.2026

CVE-2026-28445

Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

npm

@typebot.io/js

Alta 14.05.2026

CVE-2026-45665

Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

npm

open-webui

Alta 08.05.2026

CVE-2026-44721

open-webui Vulnerable to Stored XSS via Model Description

npm Python (PyPI)

open-webui

Media 05.05.2026

CVE-2026-42338

ip-address has XSS in Address6 HTML-emitting methods

npm

ip-address

Alta 05.05.2026

ghsa-g485-8j3v-p6x8

@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin

npm

@tdurieux/anonymous_github

Media 22.04.2026

CVE-2026-41692

i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes

npm

i18nextify

Media 22.04.2026

CVE-2026-41240

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

npm

dompurify