Understand vulnerabilities. Protect your applications.

High 09.10.2026

CVE-2026-108260

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.

npm

@tinacms/web-components

Low 05.10.2026

CVE-2026-109345

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

npm

dompurify

Low 30.09.2026

CVE-2026-109344

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

npm

dompurify

High 17.09.2026

CVE-2026-63459

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

npm

@vendure/dashboard

Medium 07.08.2026

CVE-2026-75838

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

npm

dompurify

High 31.07.2026

CVE-2026-58263

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

npm

jodit

Low 21.07.2026

CVE-2026-66010

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

npm

dompurify

Low 19.06.2026

ghsa-h5jc-78hr-3pc9

Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

npm

@sveltia/cms

Medium 18.06.2026

CVE-2026-65898

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

npm

dompurify

Low 15.06.2026

CVE-2026-65899

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

npm

dompurify

Low 15.06.2026

CVE-2026-65900

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

npm

dompurify

Medium 15.06.2026

CVE-2026-49978

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

npm

dompurify

Low 15.06.2026

CVE-2026-65901

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

npm

dompurify

Medium 15.06.2026

CVE-2026-65902

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

npm

dompurify

Medium 15.06.2026

CVE-2026-49458

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

npm

dompurify

Medium 15.06.2026

CVE-2026-49459

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

npm

dompurify

High 01.06.2026

CVE-2026-47423

DOMPurify XSS via selectedcontent re-clone

npm

dompurify

High 26.05.2026

CVE-2026-28445

Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview

npm

@typebot.io/js

High 14.05.2026

CVE-2026-45665

Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

npm

open-webui

High 08.05.2026

CVE-2026-44721

open-webui Vulnerable to Stored XSS via Model Description

npm Python (PyPI)

open-webui

Medium 05.05.2026

CVE-2026-42338

ip-address has XSS in Address6 HTML-emitting methods

npm

ip-address

High 05.05.2026

ghsa-g485-8j3v-p6x8

@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin

npm

@tdurieux/anonymous_github

Medium 22.04.2026

CVE-2026-41692

i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes

npm

i18nextify

Medium 22.04.2026

CVE-2026-41240

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

npm

dompurify