Cure53
Vulnerability activity for Cure53: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.1MediumOct 27, 2026Cure53 DOMPurify XSSCVE-2026-116804DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.
- 6.1MediumOct 27, 2026Cure53 DOMPurify XSSCVE-2026-116803DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.
- 6.1MediumOct 27, 2026Cure53 DOMPurify XSSCVE-2026-116802DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.
- 7.3HighSep 16, 2024Cure53 DOMPurify Denial of serviceCVE-2024-45801DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the de
Top products
- DOMPurify3 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Atlassian · May 19, 2026Atlassian Security Bulletin May 19, 2026CVE-2024-45801
- Atlassian · Apr 21, 2026Atlassian Security Bulletin April 21, 2026CVE-2024-45801
- Atlassian · Jul 15, 2025Atlassian Security Bulletin July 15, 2025CVE-2024-45801
- Atlassian · Nov 19, 2024Atlassian Security Bulletin November 19, 2024CVE-2024-45801
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.