Cure53 DOMPurify

Name: Cure53 DOMPurify
Brand: Cure53

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical0high10medium0low

updated 2026-10-28

vulnerabilities (26)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-48910US	critical9.8	1.15% (67th)	Exploit	no fix	2024-10-31	2 versions
CVE-2024-47875US	medium6.1	1.13% (66th)	Exploit	no fix	2024-10-11	4 versions
CVE-2026-47423US	—	0.41% (35th)	Exploit	3.4.5	2026-07-14	3.4.4, → 3.4.5
CVE-2020-26870US	medium6.1	4.88% (92nd)	—	no fix	2020-10-07	≤ 2.0.17
CVE-2024-45801US	medium6.1	0.89% (59th)	—	3.1.3	2024-09-16	4 versions
CVE-2025-26791US	medium6.1	0.60% (49th)	—	no fix	2025-02-14	≤ 3.2.4
CVE-2026-65899US	—	0.41% (35th)	—	3.4.9	2026-07-23	0 → 3.4.9
CVE-2026-49978US	medium6.1	0.40% (35th)	—	no fix	2026-07-14	≤ < 3.4.6
CVE-2026-49458US	—	0.40% (35th)	—	no fix	2026-07-14	≤ < 3.4.6
CVE-2026-49459US	—	0.36% (30th)	—	no fix	2026-07-14	≤ < 3.4.6
CVE-2026-65902US	medium6.1	0.36% (29th)	—	3.4.7	2026-07-23	0 → 3.4.7
CVE-2026-0540US	—	0.35% (29th)	—	no fix	2026-03-03	2 versions
CVE-2026-65911US	—	0.33% (27th)	—	3.4.0	2026-07-23	0 → 3.4.0
CVE-2026-65903US	—	0.33% (25th)	—	3.4.0	2026-07-23	0 → 3.4.0
CVE-2026-65913US	medium6.1	0.32% (25th)	—	3.3.2	2026-07-23	0 → 3.3.2
CVE-2026-41240US	medium6.1	0.31% (24th)	—	no fix	2026-04-23	2 versions
CVE-2026-65900US	—	0.31% (24th)	—	3.4.8	2026-07-23	3.0.0 → 3.4.8
CVE-2026-65914US	medium6.1	0.31% (23rd)	—	3.3.2	2026-07-23	0 → 3.3.2
CVE-2026-65912US	—	0.30% (23rd)	—	3.3.2	2026-07-23	0 → 3.3.2
CVE-2026-65901US	medium6.1	0.29% (21st)	—	no fix	2026-07-23	≤ 0 ≤3.4.6
CVE-2026-41238US	—	0.27% (19th)	—	3.4.0	2026-04-23	2 versions
CVE-2026-65904US	—	0.27% (18th)	—	no fix	2026-07-23	≤ 0 ≤3.3.3
CVE-2025-15599US	—	0.26% (17th)	—	no fix	2026-03-03	2 versions
CVE-2026-41239US	—	0.25% (16th)	—	3.4.0	2026-04-23	2 versions
CVE-2026-66010US	—	0.21% (12th)	—	3.4.12	2026-07-24	0 → 3.4.12
CVE-2026-65898US	—	0.21% (11th)	—	3.4.11	2026-07-23	0 → 3.4.11

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')19 CVEs
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')5 CVEs
CWE-693Protection Mechanism Failure5 CVEs
CWE-183Permissive List of Allowed Inputs2 CVEs
CWE-501Trust Boundary Violation2 CVEs
CWE-1289Improper Validation of Unsafe Equivalence in Input1 CVEs
CWE-1333Inefficient Regular Expression Complexity1 CVEs
CWE-184Incomplete List of Disallowed Inputs1 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)24 CVEs
RUBDU (FSTEC Data Security Threats Database)8 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan