{"schemaVersion":3,"id":"CVE-2026-49458","aliases":["UBUNTU-CVE-2026-49458","DEBIAN-CVE-2026-49458","CGA-5ffg-xgmc-x8xf","CGA-67vj-3p93-fr64","CGA-6ghh-j76c-mpxf","CGA-8wxx-j8x4-fjwc","CGA-gh85-qjwq-fpm6","CGA-gj5c-qfhm-xq4q","CGA-rjj4-g8m5-9xrm","CGA-vqrj-rwwc-f6wm","CGA-vxx9-3qxv-pr55","GHSA-hpcv-96wg-7vj8","CGA-2576-jr78-rwxh","CGA-25ch-2h4x-phwv","CGA-279q-fmq3-832f","CGA-29cq-qcvg-jvxc","CGA-2cf5-mpph-jq82","CGA-2vg7-m754-76ph","CGA-343m-74pm-x6rg","CGA-3g93-7w9v-p864","CGA-3g9c-v5vp-53fh","CGA-3vqw-m4r8-v5hm","CGA-42h2-qf7f-q2cv","CGA-47g9-75r6-r3mx","CGA-47p8-w42f-v2r6","CGA-489w-g8p3-fvpm","CGA-4jhw-8vj9-fjcp","CGA-4m4q-vmx4-8pgq","CGA-4qp5-p4pm-95hc","CGA-568c-v53c-jwr5","CGA-5gqx-mrv9-q8q4","CGA-5m24-5789-4jm7","CGA-5m27-2656-fghw","CGA-5vqx-8c97-x54w","CGA-6332-h4j7-4hf5","CGA-677g-3jpx-qqxm","CGA-683h-cjr2-j5gc","CGA-695v-g9cm-q88m","CGA-6g7g-vv6v-wppc","CGA-6q34-hqwg-mqfx","CGA-6q6j-8642-q9j3","CGA-794g-72wf-p6g8","CGA-7cm4-47p8-q649","CGA-7j68-26v5-fc3g","CGA-7jjh-92vw-m4j4","CGA-8346-9cxf-xv98","CGA-83xv-9h7x-8365","CGA-85h9-m6hj-hg3g","CGA-87j9-fx6v-ch32","CGA-8853-rhh5-f33g","CGA-8cpj-25jv-g7fj","CGA-8fj7-qp3g-fxq2","CGA-8pwh-rhpf-mr2g","CGA-8rpm-j4r3-656r","CGA-8vhv-x5jf-xfgx","CGA-92hm-p62v-8j4j","CGA-945v-398c-g67h","CGA-94m3-67q4-g6wm","CGA-9h7j-4gcw-fcmq","CGA-9p45-q5mj-2f9r","CGA-9q4v-w54f-hx38","CGA-9xv6-3hvv-3mr6","CGA-cch4-44cm-vpwj","CGA-cq4x-63cc-hmj6","CGA-cr2r-qc8p-93f6","CGA-f2jp-gf26-r2wv","CGA-f765-8v2q-5575","CGA-fc4x-vh33-65wq","CGA-fwcx-2jmm-xq9m","CGA-g88w-c2mh-qg5j","CGA-gc2p-3rjm-cw9r","CGA-gcx4-xxrv-939h","CGA-gpc2-m9j9-c34r","CGA-gqgp-v9hq-9j3q","CGA-gwqg-ffw2-jj3h","CGA-gxmc-ch5p-c5jc","CGA-gxxw-fccc-xqj5","CGA-hfm9-9qq8-c86c","CGA-hg86-wfj2-72vq","CGA-hq84-x7jr-rp53","CGA-m38x-9v84-w7xm","CGA-m4gh-92r4-6vjh","CGA-m869-945v-qfvj","CGA-m9xj-gfq2-ppfw","CGA-mh4j-8vhp-p37p","CGA-mj69-435g-mvxq","CGA-mm2c-5w8q-gpww","CGA-p3j9-c4r8-4h8h","CGA-p866-rwg5-qx54","CGA-pfm4-wf39-356v","CGA-pjr5-q5vm-qrf4","CGA-pp9h-w45q-hh6r","CGA-px8m-x3rf-j42j","CGA-q8xg-4x24-wh4f","CGA-r5gc-qcc8-76mj","CGA-rf4f-wfvh-75cx","CGA-rqqw-mhm8-mf8w","CGA-rrfj-8g9q-9r72","CGA-v49w-3xjp-2qwc","CGA-v5j3-3wx9-wpjh","CGA-vmf5-c85f-hrw5","CGA-vmfr-cr64-m68f","CGA-w2ch-855j-wvp4","CGA-w4w7-pjxq-f5xx","CGA-w9fq-xh55-3vrm","CGA-wc76-c8h9-6mq3","CGA-wgmx-cvmr-ffc2","CGA-whw2-9ww3-5h4h","CGA-wjqc-8c7j-cx8w","CGA-wm75-jx8j-xvh6","CGA-x2w8-p8vf-8hqj","CGA-x9x9-r5vx-2r84","CGA-xj58-rjg2-w7r9","CGA-xjpx-6fcw-fgq6"],"status":"published","duplicateOf":null,"title":null,"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.","dates":{"published":"2026-07-14T19:58:50.397Z","modified":"2026-07-15T13:03:02.384Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00404,"percentile":0.33272,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00404},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00404,"percentile":0.33272}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00404,"percentile":0.33272}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_CURE53_DOMPURIFY","name":"Dompurify","source":"github","url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-501","name":"Trust Boundary Violation","description":"The product mixes trusted and untrusted data in the same data structure or structured message.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/501.html"},{"id":"CWE-693","name":"Protection Mechanism Failure","description":"The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.","type":"weakness","status":"Draft","abstraction":"Pillar","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/693.html"}],"affected":[{"vendor":"chainguard","product":"airflow-2","name":"airflow-2","label":"airflow-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-core-2","name":"airflow-core-2","label":"airflow-core-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-core-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.5","name":"gitlab-rails-ce-18.5","label":"gitlab-rails-ce-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.5","name":"gitlab-rails-ce-fips-18.5","label":"gitlab-rails-ce-fips-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.188.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.188.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.188.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.188.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-31","name":"nextcloud-server-31","label":"nextcloud-server-31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-31","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-32","name":"nextcloud-server-32","label":"nextcloud-server-32","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-32","purlType":"apk","versions":[{"text":"< 32.0.12-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.12-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-34","name":"nextcloud-server-34","label":"nextcloud-server-34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-34","purlType":"apk","versions":[{"text":"< 34.0.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 34.0.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard","name":"wazuh-dashboard","label":"wazuh-dashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin","name":"wazuh-dashboard-alerting-dashboards-plugin","label":"wazuh-dashboard-alerting-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin-fips","name":"wazuh-dashboard-alerting-dashboards-plugin-fips","label":"wazuh-dashboard-alerting-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-maps","name":"wazuh-dashboard-dashboards-maps","label":"wazuh-dashboard-dashboards-maps","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-maps","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-maps-fips","name":"wazuh-dashboard-dashboards-maps-fips","label":"wazuh-dashboard-dashboards-maps-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-maps-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-notifications","name":"wazuh-dashboard-dashboards-notifications","label":"wazuh-dashboard-dashboards-notifications","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-notifications-fips","name":"wazuh-dashboard-dashboards-notifications-fips","label":"wazuh-dashboard-dashboards-notifications-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting","name":"wazuh-dashboard-dashboards-reporting","label":"wazuh-dashboard-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting-fips","name":"wazuh-dashboard-dashboards-reporting-fips","label":"wazuh-dashboard-dashboards-reporting-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-visualizations","name":"wazuh-dashboard-dashboards-visualizations","label":"wazuh-dashboard-dashboards-visualizations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-visualizations-fips","name":"wazuh-dashboard-dashboards-visualizations-fips","label":"wazuh-dashboard-dashboards-visualizations-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-fips","name":"wazuh-dashboard-fips","label":"wazuh-dashboard-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin","name":"wazuh-dashboard-index-management-dashboards-plugin","label":"wazuh-dashboard-index-management-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin-fips","name":"wazuh-dashboard-index-management-dashboards-plugin-fips","label":"wazuh-dashboard-index-management-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-plugins","name":"wazuh-dashboard-plugins","label":"wazuh-dashboard-plugins","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-plugins","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-plugins-fips","name":"wazuh-dashboard-plugins-fips","label":"wazuh-dashboard-plugins-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.188.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.188.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-32","name":"nextcloud-server-32","label":"nextcloud-server-32","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-32","purlType":"apk","versions":[{"text":"< 32.0.12-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.12-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.6-r0","eol":null,"hubHref":null},{"vendor":"cure53","product":"dompurify","name":"DOMPurify","label":"dompurify","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.4.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.6","eol":null,"hubHref":"/vendor/cure53/dompurify"},{"vendor":"debian","product":"node-dompurify","name":"node-dompurify","label":"node-dompurify","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-dompurify","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.4.12+dfsg-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.4.12+dfsg-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dompurify.js","name":"dompurify.js","label":"dompurify.js","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dompurify.js","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-dompurify","name":"node-dompurify","label":"node-dompurify","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-dompurify","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"dompurify","name":"dompurify","label":"dompurify","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/dompurify","purlType":"npm","versions":[{"text":"< 3.4.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.6","eol":null,"hubHref":null}],"affectedCount":59,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8","label":"github.com/cure53/DOMPurify/security/advisories/GHSA-hpcv-96wg-7vj8","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae","label":"github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","Patch"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.6","label":"github.com/cure53/DOMPurify/releases/tag/3.4.6","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-49458","label":"ubuntu.com/security/CVE-2026-49458","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49458","label":"www.cve.org/CVERecord?id=CVE-2026-49458","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49458","label":"security-tracker.debian.org/tracker/CVE-2026-49458","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49458.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49458.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49458","label":"nvd.nist.gov/vuln/detail/CVE-2026-49458","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/cure53/DOMPurify","label":"github.com/cure53/DOMPurify","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-X73X-RM46-Q27F"]},"timeline":[{"kind":"published","date":"2026-07-14T19:58:50.397Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-15T13:03:02.384Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T05:03:08.717Z","stale":false,"partial":false}}