Medium
CVE-2026-41692
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 63
Reset filters
Medium
CVE-2026-41240
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Medium
CVE-2026-41239
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Medium
CVE-2026-41238
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
Medium
CVE-2026-65903
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
Medium
CVE-2026-65912
DOMPurify ADD_ATTR predicate skips URI validation
Medium
CVE-2026-65913
DOMPurify USE_PROFILES prototype pollution allows event handlers
Low
CVE-2026-73427
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
Medium
CVE-2026-65914
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
Medium
CVE-2026-82868
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
High
CVE-2026-32308
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
Medium
CVE-2026-73426
Trix has a Stored XSS vulnerability through serialized attributes
Medium
CVE-2026-28401
NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
Medium
CVE-2026-28397
NocoDB Vulnerable to Stored Cross-site Scripting via Comments
Medium
CVE-2026-28398
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
Medium
CVE-2025-15599
DOMPurify contains a Cross-site Scripting vulnerability
Medium
CVE-2026-0540
DOMPurify contains a Cross-site Scripting vulnerability
High
CVE-2026-22787
html2pdf.js contains a cross-site scripting vulnerability
Critical
CVE-2026-22813
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
High
CVE-2025-65959
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
High
CVE-2025-54075
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering
Medium
CVE-2025-26791
DOMPurify allows Cross-site Scripting (XSS)
Medium
CVE-2024-53847
Trix editor subject to XSS vulnerabilities on copy & paste
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.