{"schemaVersion":3,"id":"CVE-2026-49978","aliases":["UBUNTU-CVE-2026-49978","DEBIAN-CVE-2026-49978","CGA-6852-w6cx-whmg","CGA-9j7j-rfj7-j3qp","CGA-fq8h-4hx4-jfwp","CGA-g8fx-jp2j-q9p5","CGA-gcpm-mfq2-fqm6","CGA-h7q7-hhpp-h259","CGA-j34v-6w3x-56j9","CGA-mcqp-wgpf-8qwv","CGA-xwmj-c8jf-r8c2","GHSA-rp9w-3fw7-7cwq","CGA-27g4-6qmg-48qf","CGA-2hc4-7gr6-f3fg","CGA-2j73-2h7p-9858","CGA-2jgx-25hq-wcmr","CGA-2wj7-6jw2-7q5f","CGA-3282-wv2c-6j8r","CGA-35p4-hvp3-xcw5","CGA-364v-h3h4-2896","CGA-38p7-j44r-5gpw","CGA-39wr-4vhf-3x2r","CGA-3g67-rpw2-fhc9","CGA-3vrj-v994-jxh7","CGA-435w-qxmv-p753","CGA-4462-8fpq-3v7v","CGA-44gj-2gp4-q493","CGA-47fh-v3pg-8m3p","CGA-4c8w-3m96-x55q","CGA-4x6c-3fjw-f9gr","CGA-54c7-5f56-6m8m","CGA-54j5-p9w7-pwx4","CGA-56mv-fg5h-c9f8","CGA-5jc4-mrwh-2g7g","CGA-5v74-5q3f-vgmx","CGA-668p-888m-gcwp","CGA-68c8-52gq-p25p","CGA-696w-583p-92h8","CGA-6fwj-g4cx-gc97","CGA-6w46-v368-4rpv","CGA-6x4g-m695-7779","CGA-72qq-29g2-8256","CGA-78fm-43qx-p9ff","CGA-78qv-8p46-7mpm","CGA-7f66-cx57-pj73","CGA-7pgm-gg4j-w4g9","CGA-7xwg-288h-g5r6","CGA-83vw-4rxj-m378","CGA-84h8-3fhq-hwcg","CGA-874g-v638-54q3","CGA-8cfh-3357-93pr","CGA-8gr4-hfwr-3gp5","CGA-9cmv-mxjm-hmh7","CGA-9j2r-6737-8wj9","CGA-9qp8-r7f8-cgfj","CGA-9qqp-g922-ffg4","CGA-c26v-3xc5-qw55","CGA-c3rr-4483-f59j","CGA-c5fq-8fpm-5jww","CGA-c7f5-w5h6-h4gw","CGA-cc33-vc7j-6xmg","CGA-cq5w-h5r8-m7x7","CGA-cw8j-x6rr-3xf9","CGA-f234-rjhf-4cv9","CGA-f27f-gj9w-w59h","CGA-g226-vc9c-f96x","CGA-g242-9cfh-5ff4","CGA-g5vp-558f-g45w","CGA-g9qr-83jq-93mf","CGA-gg92-c867-fcvx","CGA-gp34-575w-cg3c","CGA-gq3v-xfmh-9crh","CGA-gr92-x8mv-jj6g","CGA-grvw-2r2v-q53x","CGA-gx3q-c646-xvv2","CGA-h5gm-7c5c-53px","CGA-hjhp-c899-3hpg","CGA-hmwm-c888-6jg8","CGA-hpjf-776c-5xxq","CGA-j2v7-9rff-8wc2","CGA-j8pm-97rj-ffm8","CGA-jw8f-5377-9fcc","CGA-jwmx-3pvh-hfxq","CGA-m4mf-2v2h-rjhr","CGA-m75g-9p5m-gg7g","CGA-m862-rrq9-jjx3","CGA-mh75-3whf-3h7w","CGA-mq3m-7p8g-c76j","CGA-mw6f-v69v-99fh","CGA-p66x-43vw-qfv9","CGA-p8fv-8hw3-5c9p","CGA-pc9v-h2w5-w4mc","CGA-q675-pvxh-9697","CGA-qp6q-rvqx-h5qq","CGA-qrcp-h89v-69wr","CGA-r8vv-f85v-vwhj","CGA-rc9g-xmw5-pvrj","CGA-rgq6-6mf6-f66j","CGA-rjq6-cwc4-gf86","CGA-rmww-6fqc-vp2f","CGA-rp4p-2m4v-c7r7","CGA-rqcf-6rv6-jfmv","CGA-vffg-9f2p-3wcw","CGA-w6g7-38fw-fj5x","CGA-wc2h-6pvx-j5h6","CGA-wgww-ffp4-4gjw","CGA-wpfm-vm5p-249f","CGA-x457-x94g-632g","CGA-x9j3-h5px-9jx4","CGA-x9xp-jq5w-rx8j","CGA-xm58-c24f-g5ff","CGA-xq4f-533p-6fhr","CGA-xrqr-r8pm-cx99","CGA-xwmq-v7x5-gcv5"],"status":"published","duplicateOf":null,"title":null,"description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.","dates":{"published":"2026-07-14T20:02:46.263Z","modified":"2026-07-21T14:59:20.582Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":5.1,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00404,"percentile":0.33272,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.07,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00334},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00404,"percentile":0.33272}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00334,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00404,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00404,"percentile":0.33272}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_CURE53_DOMPURIFY","name":"Dompurify","source":"github","url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"chainguard","product":"airflow-2","name":"airflow-2","label":"airflow-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"airflow-core-2","name":"airflow-core-2","label":"airflow-core-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/airflow-core-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.5","name":"gitlab-rails-ce-18.5","label":"gitlab-rails-ce-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.5","name":"gitlab-rails-ce-fips-18.5","label":"gitlab-rails-ce-fips-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.191.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.191.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.192.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.192.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-31","name":"nextcloud-server-31","label":"nextcloud-server-31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-31","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-32","name":"nextcloud-server-32","label":"nextcloud-server-32","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-32","purlType":"apk","versions":[{"text":"< 32.0.12-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.12-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.6-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-34","name":"nextcloud-server-34","label":"nextcloud-server-34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-34","purlType":"apk","versions":[{"text":"< 34.0.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 34.0.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard","name":"wazuh-dashboard","label":"wazuh-dashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin","name":"wazuh-dashboard-alerting-dashboards-plugin","label":"wazuh-dashboard-alerting-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin-fips","name":"wazuh-dashboard-alerting-dashboards-plugin-fips","label":"wazuh-dashboard-alerting-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-maps","name":"wazuh-dashboard-dashboards-maps","label":"wazuh-dashboard-dashboards-maps","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-maps","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-maps-fips","name":"wazuh-dashboard-dashboards-maps-fips","label":"wazuh-dashboard-dashboards-maps-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-maps-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-notifications","name":"wazuh-dashboard-dashboards-notifications","label":"wazuh-dashboard-dashboards-notifications","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-notifications-fips","name":"wazuh-dashboard-dashboards-notifications-fips","label":"wazuh-dashboard-dashboards-notifications-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-notifications-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting","name":"wazuh-dashboard-dashboards-reporting","label":"wazuh-dashboard-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting-fips","name":"wazuh-dashboard-dashboards-reporting-fips","label":"wazuh-dashboard-dashboards-reporting-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-visualizations","name":"wazuh-dashboard-dashboards-visualizations","label":"wazuh-dashboard-dashboards-visualizations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-visualizations-fips","name":"wazuh-dashboard-dashboards-visualizations-fips","label":"wazuh-dashboard-dashboards-visualizations-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-fips","name":"wazuh-dashboard-fips","label":"wazuh-dashboard-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin","name":"wazuh-dashboard-index-management-dashboards-plugin","label":"wazuh-dashboard-index-management-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin-fips","name":"wazuh-dashboard-index-management-dashboards-plugin-fips","label":"wazuh-dashboard-index-management-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-plugins","name":"wazuh-dashboard-plugins","label":"wazuh-dashboard-plugins","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-plugins","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-plugins-fips","name":"wazuh-dashboard-plugins-fips","label":"wazuh-dashboard-plugins-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-plugins-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-compat","name":"langfuse-3-compat","label":"langfuse-3-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-compat","purlType":"apk","versions":[{"text":"< 3.225.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.225.7-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.191.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.191.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-32","name":"nextcloud-server-32","label":"nextcloud-server-32","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-32","purlType":"apk","versions":[{"text":"< 32.0.12-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 32.0.12-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.6-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.6-r0","eol":null,"hubHref":null},{"vendor":"cure53","product":"dompurify","name":"DOMPurify","label":"dompurify","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.4.6","noFixRecorded":false,"fixedIn":null},{"text":"< 3.4.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.6 | < 3.4.7","eol":null,"hubHref":"/vendor/cure53/dompurify"},{"vendor":"debian","product":"node-dompurify","name":"node-dompurify","label":"node-dompurify","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-dompurify","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.4.12+dfsg-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.4.12+dfsg-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"dompurify.js","name":"dompurify.js","label":"dompurify.js","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/dompurify.js","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-dompurify","name":"node-dompurify","label":"node-dompurify","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-dompurify","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"dompurify","name":"dompurify","label":"dompurify","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/dompurify","purlType":"npm","versions":[{"text":"< 3.4.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.7","eol":null,"hubHref":null}],"affectedCount":59,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","label":"github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Vendor Advisory","Exploit"]},{"url":"https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","label":"github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","Patch"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.7","label":"github.com/cure53/DOMPurify/releases/tag/3.4.7","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-49978","label":"ubuntu.com/security/CVE-2026-49978","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49978","label":"www.cve.org/CVERecord?id=CVE-2026-49978","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49978","label":"security-tracker.debian.org/tracker/CVE-2026-49978","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49978.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49978.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","label":"nvd.nist.gov/vuln/detail/CVE-2026-49978","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/cure53/DOMPurify","label":"github.com/cure53/DOMPurify","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:57590"],"duplicates":[],"related":["CGA-4JCF-P633-VP8V"]},"timeline":[{"kind":"published","date":"2026-07-14T20:02:46.263Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-21T14:59:20.582Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T06:57:36.380Z","stale":false,"partial":false}}