https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-21T17:38:22.179503+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-109345 fkie_cve-2026-109345 2026-10-21T17:38:22.217181+00:00

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

 https://db.gcve.eu/vuln/ghsa-cjhx-p48c-gfm9 GHSA-cjhx-p48c-gfm9 2026-10-21T17:38:22.217319+00:00

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-109345 UBUNTU-CVE-2026-109345 2026-10-21T17:38:22.217347+00:00

Affected: Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.10: node-dompurify, Ubuntu:26.04:LTS: node-dompurify

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.