[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-65904":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":20,"aliases":30,"duplicate_of":9,"upstream":33,"downstream":34,"duplicates":37,"related":38,"reserved_at":9,"published_at":39,"modified_at":40,"state":41,"summary":42,"references_raw":50,"kevs":79,"epss":80,"epss_history":83,"metrics":256,"affected":275},"CVE-2026-65904","DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-754","Improper Check for Unusual or Exceptional Conditions","The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.","weakness","Incomplete","Class","Medium",[],[21],{"_key":22,"name":23,"source":24,"url":25,"maturity":26,"reliability_score":27,"verified":28,"type":9,"platforms":29,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_CURE53_DOMPURIFY","Dompurify","github","https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf","poc",0.3,false,[],[31,32],"UBUNTU-CVE-2026-65904","DEBIAN-CVE-2026-65904",[],[35],{"_key":36},"RHSA-2026:54517",[],[],"2026-07-23T13:16:22.069Z","2026-07-24T21:35:25.747Z","Analyzed",{"cisa_kev":28,"cisa_ransomware":28,"cisa_vendor":9,"epss_severity":43,"epss_score":44,"severity":45,"severity_score":46,"severity_version":47,"severity_source":48,"severity_vector":49,"severity_status":41},"low",0.00206,"medium",4.7,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",[51,61,65,69,73],{"url":52,"sources":53,"tags":56},"https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934",[48,54,55],"nvd","osv_ubuntu",[57,58,59,60],"Vendor Advisory","Exploit","Third Party Advisory","REPORT",{"url":62,"sources":63,"tags":64},"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode",[48,54],[59],{"url":66,"sources":67,"tags":68},"https://ubuntu.com/security/CVE-2026-65904",[55],[60],{"url":70,"sources":71,"tags":72},"https://www.cve.org/CVERecord?id=CVE-2026-65904",[55],[60],{"url":74,"sources":75,"tags":77},"https://security-tracker.debian.org/tracker/CVE-2026-65904",[76],"osv_debian",[78],"Advisory",[],{"date":81,"score":44,"percentile":82},"2026-09-19",0.10947,[84,88,91,94,97,100,104,107,110,113,116,119,121,124,127,130,133,136,138,140,143,146,149,152,155,158,161,164,167,170,174,177,180,183,186,189,192,195,198,201,204,207,210,213,216,219,222,225,228,231,234,237,240,243,246,249,252,255],{"date":85,"score":86,"percentile":87},"2026-07-24",0.00154,0.04977,{"date":89,"score":86,"percentile":90},"2026-07-25",0.04974,{"date":92,"score":86,"percentile":93},"2026-07-26",0.04972,{"date":95,"score":86,"percentile":96},"2026-07-27",0.04982,{"date":98,"score":86,"percentile":99},"2026-07-28",0.04999,{"date":101,"score":102,"percentile":103},"2026-07-29",0.00165,0.06123,{"date":105,"score":102,"percentile":106},"2026-07-30",0.06136,{"date":108,"score":102,"percentile":109},"2026-07-31",0.06145,{"date":111,"score":102,"percentile":112},"2026-08-01",0.06135,{"date":114,"score":102,"percentile":115},"2026-08-02",0.06131,{"date":117,"score":102,"percentile":118},"2026-08-03",0.06138,{"date":120,"score":102,"percentile":103},"2026-08-04",{"date":122,"score":102,"percentile":123},"2026-08-05",0.06108,{"date":125,"score":102,"percentile":126},"2026-08-06",0.06105,{"date":128,"score":102,"percentile":129},"2026-08-07",0.06103,{"date":131,"score":102,"percentile":132},"2026-08-08",0.06104,{"date":134,"score":102,"percentile":135},"2026-08-09",0.061,{"date":137,"score":102,"percentile":126},"2026-08-10",{"date":139,"score":102,"percentile":123},"2026-08-11",{"date":141,"score":102,"percentile":142},"2026-08-12",0.06127,{"date":144,"score":102,"percentile":145},"2026-08-13",0.0613,{"date":147,"score":102,"percentile":148},"2026-08-14",0.0616,{"date":150,"score":102,"percentile":151},"2026-08-15",0.06159,{"date":153,"score":102,"percentile":154},"2026-08-16",0.06161,{"date":156,"score":102,"percentile":157},"2026-08-17",0.06194,{"date":159,"score":102,"percentile":160},"2026-08-18",0.06176,{"date":162,"score":102,"percentile":163},"2026-08-19",0.06207,{"date":165,"score":102,"percentile":166},"2026-08-20",0.06213,{"date":168,"score":102,"percentile":169},"2026-08-21",0.06205,{"date":171,"score":172,"percentile":173},"2026-08-22",0.00177,0.07581,{"date":175,"score":172,"percentile":176},"2026-08-23",0.07552,{"date":178,"score":44,"percentile":179},"2026-08-24",0.10469,{"date":181,"score":44,"percentile":182},"2026-08-25",0.1047,{"date":184,"score":44,"percentile":185},"2026-08-26",0.10506,{"date":187,"score":44,"percentile":188},"2026-08-27",0.10522,{"date":190,"score":44,"percentile":191},"2026-08-28",0.10546,{"date":193,"score":44,"percentile":194},"2026-08-29",0.10547,{"date":196,"score":44,"percentile":197},"2026-08-30",0.10557,{"date":199,"score":44,"percentile":200},"2026-08-31",0.1056,{"date":202,"score":44,"percentile":203},"2026-09-01",0.10573,{"date":205,"score":44,"percentile":206},"2026-09-02",0.10577,{"date":208,"score":44,"percentile":209},"2026-09-03",0.10567,{"date":211,"score":44,"percentile":212},"2026-09-04",0.10576,{"date":214,"score":44,"percentile":215},"2026-09-05",0.10605,{"date":217,"score":44,"percentile":218},"2026-09-06",0.10618,{"date":220,"score":44,"percentile":221},"2026-09-07",0.10608,{"date":223,"score":44,"percentile":224},"2026-09-08",0.10613,{"date":226,"score":44,"percentile":227},"2026-09-09",0.1067,{"date":229,"score":44,"percentile":230},"2026-09-10",0.10662,{"date":232,"score":44,"percentile":233},"2026-09-11",0.10653,{"date":235,"score":44,"percentile":236},"2026-09-12",0.10756,{"date":238,"score":44,"percentile":239},"2026-09-13",0.10716,{"date":241,"score":44,"percentile":242},"2026-09-14",0.10728,{"date":244,"score":44,"percentile":245},"2026-09-15",0.10779,{"date":247,"score":44,"percentile":248},"2026-09-16",0.10824,{"date":250,"score":44,"percentile":251},"2026-09-17",0.10863,{"date":253,"score":44,"percentile":254},"2026-09-18",0.10963,{"date":81,"score":44,"percentile":82},[257,266,270,273],{"source":48,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":258,"cvss_v4_0":262},{"baseScore":46,"baseSeverity":259,"vectorString":49,"impactScore":260,"exploitabilityScore":261},"MEDIUM",4.5,4.1,{"baseScore":263,"baseSeverity":264,"vectorString":265,"impactScore":9,"exploitabilityScore":9},2.3,"LOW","CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",{"source":54,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":267,"cvss_v4_0":268},{"baseScore":46,"baseSeverity":259,"vectorString":49,"impactScore":260,"exploitabilityScore":261},{"baseScore":263,"baseSeverity":264,"vectorString":269,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":55,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":271,"cvss_v4_0":272},{"baseScore":46,"baseSeverity":9,"vectorString":49,"impactScore":260,"exploitabilityScore":261},{"baseScore":263,"baseSeverity":9,"vectorString":265,"impactScore":9,"exploitabilityScore":9},{"source":76,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":274},{"baseScore":263,"baseSeverity":9,"vectorString":269,"impactScore":9,"exploitabilityScore":9},[276,292,305],{"ecosystem":9,"name":277,"vendor":278,"product":279,"cpe_part":280,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":281},"DOMPurify","cure53","dompurify","a",[282,287],{"version":283,"is_range":284,"range_type":48,"version_start":9,"version_start_type":9,"version_end":285,"version_end_type":286,"fixed_in":9},"\u003C= 3.3.3",true,"3.3.3","including",{"version":288,"is_range":284,"range_type":289,"version_start":9,"version_start_type":9,"version_end":290,"version_end_type":291,"fixed_in":9},"lt3.4.4","cpe","3.4.4","excluding",{"ecosystem":293,"name":294,"vendor":295,"product":294,"cpe_part":9,"purl_type":296,"purl_namespace":295,"purl_name":294,"source":9,"versions":297},"Debian","node-dompurify","debian","deb",[298,301,302],{"version":299,"is_range":284,"range_type":300,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all","ecosystem",{"version":299,"is_range":284,"range_type":300,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":303,"is_range":284,"range_type":300,"version_start":9,"version_start_type":9,"version_end":304,"version_end_type":291,"fixed_in":9},"lt3_4_5+dfsg_1","3.4.5+dfsg-1",{"ecosystem":306,"name":294,"vendor":307,"product":294,"cpe_part":9,"purl_type":296,"purl_namespace":307,"purl_name":294,"source":9,"versions":308},"Ubuntu","ubuntu",[309,310,311],{"version":299,"is_range":284,"range_type":300,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":299,"is_range":284,"range_type":300,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":299,"is_range":284,"range_type":300,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9}]