{"id":"CVE-2026-0540","aliases":["CLSA-2026-1778460305","CLSA-2026-1778805976","CLSA-2026-1784596279","CLSA-2026-1789139223","CLSA-2026-1789155876","CLSA-2026-1792155851","CLSA-2026-1792156282","CLSA-2026-1792161492","DEBIAN-CVE-2026-0540","EUVD-2026-9303","GHSA-39q2-94rc-95cp","GHSA-55q2-fjhq-7xh7","GHSA-76mc-f452-cxcm","GHSA-cj63-jhhr-wcxv","GHSA-cjmm-f4jc-qw8r","GHSA-cmwh-pvxp-8882","GHSA-gvmj-g25r-r7wr","GHSA-h8r8-wccr-v5f2","GHSA-v2wj-7wpq-c8vv","GHSA-vxr8-fq34-vvx9","GHSA-x4vx-rjvf-j5p4","ROOT-APP-NPM-CVE-2026-0540","UBUNTU-CVE-2026-0540","openSUSE-SU-2026:10599-1"],"status":"published","title":"DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like \u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00388,"percentile":0.33211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-03-03T17:26:06Z","modified":"2026-10-28T20:16:39Z","fixes":[{"ecosystem":"npm","package":"dompurify","fixed_in":["3.3.2","2.5.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-dompurify","fixed_in":["3.3.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"dompurify","fixed_in":["2.5.8-aikido.3","3.2.4-aikido.1","2.5.8-aikido.1","3.2.4-aikido.2","3.2.4-aikido.3","2.5.8-aikido.2","3.2.4-aikido.4","3.2.4-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/dompurify","fixed_in":["2.5.8-root.io.3","3.2.4-root.io.1","2.5.8-root.io.1","3.2.4-root.io.2","3.2.4-root.io.3","2.5.8-root.io.2","3.2.4-root.io.4","3.2.4-root.io.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cacti","fixed_in":["1.2.30+git306.82d5aef5-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3"},{"last_affected":"3.3.1"},{"fixed":"3.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.3"},{"last_affected":"2.5.8"},{"fixed":"2.5.9"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6-tuxcare.0"},{"fixed":"3.1.6-tuxcare.2"}]}],"versions":["3.1.6","3.1.6-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.3-tuxcare.0"},{"fixed":"3.2.3-tuxcare.1"}]}],"versions":["3.2.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.2"}]}],"versions":["3.0.3","3.0.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-tuxcare.0"},{"fixed":"3.2.7-tuxcare.2"}]}],"versions":["3.2.7","3.2.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.8-tuxcare.0"},{"fixed":"2.5.8-tuxcare.7"}]}],"versions":["2.5.8","2.5.8-tuxcare.1","2.5.8-tuxcare.2","2.5.8-tuxcare.3","2.5.8-tuxcare.4","2.5.8-tuxcare.5","2.5.8-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.2"}]}],"versions":["3.1.3","3.1.3-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.2"}]}],"versions":["3.1.4","3.1.4-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.6-tuxcare.0"},{"fixed":"3.2.6-tuxcare.2"}]}],"versions":["3.2.6","3.2.6-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","2.4.1+dfsg+~2.4.0-2","2.4.1+dfsg+~2.4.0-2+deb12u1","3.0.9+dfsg+~3.0.5-1","3.1.6+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2+dfsg-1"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"dompurify","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.3"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"dompurify","ranges":[{"type":"SEMVER","events":[{"introduced":"2.5.3"},{"fixed":"2.5.9"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-aikido.3"},{"fixed":"3.2.4-aikido.1"},{"fixed":"2.5.8-aikido.1"},{"fixed":"3.2.4-aikido.2"},{"fixed":"3.2.4-aikido.3"},{"fixed":"2.5.8-aikido.2"},{"fixed":"3.2.4-aikido.4"},{"fixed":"3.2.4-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-root.io.3"},{"fixed":"3.2.4-root.io.1"},{"fixed":"2.5.8-root.io.1"},{"fixed":"3.2.4-root.io.2"},{"fixed":"3.2.4-root.io.3"},{"fixed":"2.5.8-root.io.2"},{"fixed":"3.2.4-root.io.4"},{"fixed":"3.2.4-root.io.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-2","2.3.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","3.0.9+dfsg+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.3+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.3.3+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.30+git306.82d5aef5-1.1"}]}]}],"products":[{"vendor":"cure53","product":"dompurify"}],"references":[{"url":"https://github.com/cure53/DOMPurify","tags":["product","Product","package","report"]},{"url":"https://github.com/cure53/DOMPurify/commit/302b51de22535cc90235472c52e3401bedd46f80","tags":["patch","fix","web"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.3.2","tags":["release-notes","advisory","web"]},{"url":"https://fluidattacks.com/advisories/daft","tags":["third-party-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/dompurify-xss-via-missing-rawtext-elements-in-safe-for-xml","tags":["third-party-advisory","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0540","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/fca0a938b4261ddc9c0293a289935a9029c049f5","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-v2wj-7wpq-c8vv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0540.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-0540","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-0540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0540","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0540","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-0540","title":"DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like \u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T17:26:06.621Z","modified":"2026-03-25T15:52:12.404Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-9303","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like \u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T17:26:06Z","modified":"2026-03-25T15:52:12Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:29.129467Z"}],"ghsa":[{"id":"GHSA-v2wj-7wpq-c8vv","title":"DOMPurify contains a Cross-site Scripting vulnerability","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `\u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T18:31:33Z","modified":"2026-03-30T14:51:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:46.119458Z"}],"nvd":[{"id":"CVE-2026-0540","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like \u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T18:16:24.457Z","modified":"2026-06-17T10:10:54.79Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:07.420927Z"}],"osv":[{"id":"CVE-2026-0540","title":"DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like \u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T17:26:06.621Z","modified":"2026-10-28T02:30:25.500568705Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"DEBIAN-CVE-2026-0540","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like \u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T18:16:24.457Z","modified":"2026-10-01T03:00:18.548056748Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-v2wj-7wpq-c8vv","title":"DOMPurify contains a Cross-site Scripting vulnerability","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `\u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T18:31:33Z","modified":"2026-09-10T03:50:41.055616171Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"UBUNTU-CVE-2026-0540","description":"DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like \u003c/noscript\u003e\u003cimg src=x onerror=alert(1)\u003e in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.","status":"published","published":"2026-03-03T18:16:00Z","modified":"2026-10-28T20:16:39.060333117Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"CLSA-2026-1778460305","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.1.6-tuxcare.2.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:29.069833144Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778805976","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:31.523670706Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1784596279","title":"TuxCare security update for dompurify (7 CVEs)","description":"TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:52.647728924Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1789139223","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.2.7-tuxcare.2.","status":"published","published":"2026-09-11T15:07:03Z","modified":"2026-10-15T09:47:56.104879508Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789155876","title":"TuxCare security update for dompurify (8 CVEs)","description":"TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 2.5.8-tuxcare.7.","status":"published","published":"2026-09-11T19:44:36Z","modified":"2026-10-16T19:13:12.430055203Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792155851","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.","status":"published","published":"2026-10-16T13:04:11Z","modified":"2026-10-21T20:43:23.163914038Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156282","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.4-tuxcare.2.","status":"published","published":"2026-10-16T13:11:22Z","modified":"2026-10-21T20:43:22.552871845Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161492","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.6-tuxcare.2.","status":"published","published":"2026-10-16T14:38:11Z","modified":"2026-10-16T16:30:09.033084778Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"openSUSE-SU-2026:10599-1","title":"cacti-1.2.30+git306.82d5aef5-1.1 on GA media","description":"These are all security issues fixed in the cacti-1.2.30+git306.82d5aef5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-22T00:00:00Z","modified":"2026-04-23T08:45:19.462017Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"ROOT-APP-NPM-CVE-2026-0540","title":"CVE-2026-0540 in dompurify - Patched by Root","description":"Root has patched CVE-2026-0540 in the dompurify package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-28T04:55:46Z","modified":"2026-10-28T05:15:04.097117089Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}