[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-65912":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":45,"duplicate_of":9,"upstream":85,"downstream":88,"duplicates":93,"related":94,"reserved_at":9,"published_at":97,"modified_at":98,"state":99,"summary":100,"references_raw":109,"kevs":157,"epss":158,"epss_history":161,"metrics":329,"affected":353},"CVE-2026-65912","DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-79","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-209","XSS Using MIME Type Mismatch",[],{"id":25,"name":26,"techniques":27},"CAPEC-588","DOM-Based XSS",[],{"id":29,"name":30,"techniques":31},"CAPEC-591","Reflected XSS",[],{"id":33,"name":34,"techniques":35},"CAPEC-592","Stored XSS",[],{"id":37,"name":38,"techniques":39},"CAPEC-63","Cross-Site Scripting (XSS)",[],{"id":41,"name":42,"techniques":43},"CAPEC-85","AJAX Footprinting",[],[],[46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84],"UBUNTU-CVE-2026-65912","DEBIAN-CVE-2026-65912","GHSA-cjmm-f4jc-qw8r","CGA-23x3-29x5-76p4","CGA-2xrr-9rq7-6gf6","CGA-3449-xc98-43jx","CGA-35jr-564p-mghv","CGA-3cch-v44h-jqfh","CGA-42fj-5ggj-gmwg","CGA-64vg-jrrc-7xxq","CGA-67j6-wvxr-233g","CGA-6fgj-r358-m68h","CGA-7c9v-7m44-v5pv","CGA-97j7-4749-pqq8","CGA-99hj-xv6h-jmq9","CGA-c22j-gvrq-fvxx","CGA-c7xq-g3p2-frvp","CGA-cjxm-xmw9-c55p","CGA-f76w-5fhc-3qj4","CGA-f8rw-5frr-vm5f","CGA-fvm3-pq37-7x5c","CGA-gcch-hjmr-rgw6","CGA-h46x-x256-26ww","CGA-jr6g-fmr8-hx34","CGA-mjxg-hvfj-9ffp","CGA-mwh6-r467-gxhh","CGA-p4hg-cwfc-42cw","CGA-pp2r-rghh-9vmp","CGA-q9cf-2vmv-xhv5","CGA-rh5h-pm8f-2658","CGA-rmpw-g397-85gh","CGA-rq7h-gqj5-vw2q","CGA-rrm4-8957-xmrw","CGA-rvrj-29w4-8w2f","CGA-vhx2-8wcv-2rj7","CGA-w6v2-xc4j-xm6j","CGA-x4r6-4532-7x3c","CGA-x9rv-3jfm-hr45","CGA-xvf6-8458-mf4p",[86],{"_key":87},"GHSA-CJMM-F4JC-QW8R",[89,91],{"_key":90},"RHSA-2026:58500",{"_key":92},"RHSA-2026:54517",[],[95],{"_key":96},"CGA-J284-H3MR-P3Q6","2026-07-23T13:16:23.406Z","2026-07-23T15:46:09.055Z","Analyzed",{"cisa_kev":101,"cisa_ransomware":101,"cisa_vendor":9,"epss_severity":102,"epss_score":103,"severity":104,"severity_score":105,"severity_version":106,"severity_source":107,"severity_vector":108,"severity_status":99},false,"low",0.00175,"medium",6.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",[110,123,127,131,135,140,145,149,153],{"url":111,"sources":112,"tags":117},"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r",[107,113,114,115,116],"nvd","osv_ubuntu","osv_npm","osv_chainguard",[118,119,120,121,122],"Vendor Advisory","Third Party Advisory","REPORT","WEB","Advisory",{"url":124,"sources":125,"tags":126},"https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr",[107,113,116],[119,122],{"url":128,"sources":129,"tags":130},"https://ubuntu.com/security/CVE-2026-65912",[114],[120],{"url":132,"sources":133,"tags":134},"https://www.cve.org/CVERecord?id=CVE-2026-65912",[114],[120],{"url":136,"sources":137,"tags":139},"https://security-tracker.debian.org/tracker/CVE-2026-65912",[138],"osv_debian",[122],{"url":141,"sources":142,"tags":143},"https://github.com/cure53/DOMPurify",[115],[144],"PACKAGE",{"url":146,"sources":147,"tags":148},"https://github.com/cure53/DOMPurify/releases/tag/3.3.2",[115],[121],{"url":150,"sources":151,"tags":152},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65912.json",[116],[122],{"url":154,"sources":155,"tags":156},"https://nvd.nist.gov/vuln/detail/CVE-2026-65912",[116],[122],[],{"date":159,"score":103,"percentile":160},"2026-09-19",0.07265,[162,166,169,172,175,178,181,183,186,189,192,195,198,201,204,207,210,213,216,219,222,224,227,230,233,236,239,242,245,248,251,254,257,260,263,266,269,272,275,277,280,282,284,287,290,293,296,299,302,304,307,310,313,316,319,322,325,328],{"date":163,"score":164,"percentile":165},"2026-07-24",0.00168,0.06435,{"date":167,"score":164,"percentile":168},"2026-07-25",0.06433,{"date":170,"score":164,"percentile":171},"2026-07-26",0.06447,{"date":173,"score":164,"percentile":174},"2026-07-27",0.06452,{"date":176,"score":164,"percentile":177},"2026-07-28",0.06487,{"date":179,"score":103,"percentile":180},"2026-07-29",0.07198,{"date":182,"score":103,"percentile":180},"2026-07-30",{"date":184,"score":103,"percentile":185},"2026-07-31",0.07201,{"date":187,"score":103,"percentile":188},"2026-08-01",0.07186,{"date":190,"score":103,"percentile":191},"2026-08-02",0.07167,{"date":193,"score":103,"percentile":194},"2026-08-03",0.07168,{"date":196,"score":103,"percentile":197},"2026-08-04",0.07152,{"date":199,"score":103,"percentile":200},"2026-08-05",0.07138,{"date":202,"score":103,"percentile":203},"2026-08-06",0.07119,{"date":205,"score":103,"percentile":206},"2026-08-07",0.07116,{"date":208,"score":103,"percentile":209},"2026-08-08",0.07114,{"date":211,"score":103,"percentile":212},"2026-08-09",0.07108,{"date":214,"score":103,"percentile":215},"2026-08-10",0.07115,{"date":217,"score":103,"percentile":218},"2026-08-11",0.07146,{"date":220,"score":103,"percentile":221},"2026-08-12",0.07155,{"date":223,"score":103,"percentile":197},"2026-08-13",{"date":225,"score":103,"percentile":226},"2026-08-14",0.07166,{"date":228,"score":103,"percentile":229},"2026-08-15",0.07187,{"date":231,"score":103,"percentile":232},"2026-08-16",0.07214,{"date":234,"score":103,"percentile":235},"2026-08-17",0.07229,{"date":237,"score":103,"percentile":238},"2026-08-18",0.07221,{"date":240,"score":103,"percentile":241},"2026-08-19",0.07254,{"date":243,"score":103,"percentile":244},"2026-08-20",0.07253,{"date":246,"score":103,"percentile":247},"2026-08-21",0.07246,{"date":249,"score":103,"percentile":250},"2026-08-22",0.07245,{"date":252,"score":103,"percentile":253},"2026-08-23",0.07219,{"date":255,"score":103,"percentile":256},"2026-08-24",0.06949,{"date":258,"score":103,"percentile":259},"2026-08-25",0.06957,{"date":261,"score":103,"percentile":262},"2026-08-26",0.06974,{"date":264,"score":103,"percentile":265},"2026-08-27",0.07008,{"date":267,"score":103,"percentile":268},"2026-08-28",0.07025,{"date":270,"score":103,"percentile":271},"2026-08-29",0.07023,{"date":273,"score":103,"percentile":274},"2026-08-30",0.07038,{"date":276,"score":103,"percentile":274},"2026-08-31",{"date":278,"score":103,"percentile":279},"2026-09-01",0.07037,{"date":281,"score":103,"percentile":279},"2026-09-02",{"date":283,"score":103,"percentile":268},"2026-09-03",{"date":285,"score":103,"percentile":286},"2026-09-04",0.07039,{"date":288,"score":103,"percentile":289},"2026-09-05",0.07057,{"date":291,"score":103,"percentile":292},"2026-09-06",0.07075,{"date":294,"score":103,"percentile":295},"2026-09-07",0.07065,{"date":297,"score":103,"percentile":298},"2026-09-08",0.07049,{"date":300,"score":103,"percentile":301},"2026-09-09",0.07088,{"date":303,"score":103,"percentile":292},"2026-09-10",{"date":305,"score":103,"percentile":306},"2026-09-11",0.07079,{"date":308,"score":103,"percentile":309},"2026-09-12",0.07132,{"date":311,"score":103,"percentile":312},"2026-09-13",0.07127,{"date":314,"score":103,"percentile":315},"2026-09-14",0.07139,{"date":317,"score":103,"percentile":318},"2026-09-15",0.07171,{"date":320,"score":103,"percentile":321},"2026-09-16",0.07215,{"date":323,"score":103,"percentile":324},"2026-09-17",0.07239,{"date":326,"score":103,"percentile":327},"2026-09-18",0.07251,{"date":159,"score":103,"percentile":160},[330,338,342,345,347,351],{"source":107,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":331,"cvss_v4_0":335},{"baseScore":105,"baseSeverity":332,"vectorString":108,"impactScore":333,"exploitabilityScore":334},"MEDIUM",4.5,7.2,{"baseScore":336,"baseSeverity":332,"vectorString":337,"impactScore":9,"exploitabilityScore":9},5.1,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",{"source":113,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":339,"cvss_v4_0":340},{"baseScore":105,"baseSeverity":332,"vectorString":108,"impactScore":333,"exploitabilityScore":334},{"baseScore":336,"baseSeverity":332,"vectorString":341,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":114,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":343,"cvss_v4_0":344},{"baseScore":105,"baseSeverity":9,"vectorString":108,"impactScore":333,"exploitabilityScore":334},{"baseScore":336,"baseSeverity":9,"vectorString":337,"impactScore":9,"exploitabilityScore":9},{"source":138,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":346},{"baseScore":336,"baseSeverity":9,"vectorString":341,"impactScore":9,"exploitabilityScore":9},{"source":115,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":348},{"baseScore":349,"baseSeverity":9,"vectorString":350,"impactScore":9,"exploitabilityScore":9},5.3,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",{"source":116,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":352},{"baseScore":336,"baseSeverity":9,"vectorString":337,"impactScore":9,"exploitabilityScore":9},[354,364,368,372,376,380,384,388,392,396,400,404,408,412,416,420,424,428,435,445,456,462],{"ecosystem":355,"name":356,"vendor":357,"product":356,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":356,"source":9,"versions":359},"Chainguard","airflow-2","chainguard","apk",[360],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"ecosystem":355,"name":365,"vendor":357,"product":365,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":365,"source":9,"versions":366},"airflow-core-2",[367],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":369,"vendor":357,"product":369,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":369,"source":9,"versions":370},"gitlab-rails-ce-18.1",[371],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":373,"vendor":357,"product":373,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":373,"source":9,"versions":374},"gitlab-rails-ce-18.5",[375],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":377,"vendor":357,"product":377,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":377,"source":9,"versions":378},"gitlab-rails-ce-18.6",[379],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":381,"vendor":357,"product":381,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":381,"source":9,"versions":382},"gitlab-rails-ce-18.7",[383],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":385,"vendor":357,"product":385,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":385,"source":9,"versions":386},"gitlab-rails-ce-18.8",[387],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":389,"vendor":357,"product":389,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":389,"source":9,"versions":390},"gitlab-rails-ce-18.9",[391],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":393,"vendor":357,"product":393,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":393,"source":9,"versions":394},"gitlab-rails-ce-fips-18.1",[395],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":397,"vendor":357,"product":397,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":397,"source":9,"versions":398},"gitlab-rails-ce-fips-18.5",[399],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":401,"vendor":357,"product":401,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":401,"source":9,"versions":402},"gitlab-rails-ce-fips-18.6",[403],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":405,"vendor":357,"product":405,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":405,"source":9,"versions":406},"gitlab-rails-ce-fips-18.7",[407],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":409,"vendor":357,"product":409,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":409,"source":9,"versions":410},"gitlab-rails-ce-fips-18.8",[411],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":413,"vendor":357,"product":413,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":413,"source":9,"versions":414},"gitlab-rails-ce-fips-18.9",[415],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":417,"vendor":357,"product":417,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":417,"source":9,"versions":418},"langfuse-fips-3.152",[419],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":421,"vendor":357,"product":421,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":421,"source":9,"versions":422},"langfuse-fips-3.152-worker",[423],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":425,"vendor":357,"product":425,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":425,"source":9,"versions":426},"nextcloud-server-31",[427],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":355,"name":429,"vendor":357,"product":429,"cpe_part":9,"purl_type":358,"purl_namespace":357,"purl_name":429,"source":9,"versions":430},"wazuh-dashboard-plugins",[431],{"version":432,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":433,"version_end_type":434,"fixed_in":9},"lt4_14_4_r1","4.14.4-r1","excluding",{"ecosystem":9,"name":436,"vendor":437,"product":438,"cpe_part":439,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":440},"DOMPurify","cure53","dompurify","a",[441],{"version":442,"is_range":362,"range_type":443,"version_start":9,"version_start_type":9,"version_end":444,"version_end_type":434,"fixed_in":9},"lt3.3.2","cpe","3.3.2",{"ecosystem":446,"name":447,"vendor":448,"product":447,"cpe_part":9,"purl_type":449,"purl_namespace":448,"purl_name":447,"source":9,"versions":450},"Debian","node-dompurify","debian","deb",[451,452,453],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":454,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":455,"version_end_type":434,"fixed_in":9},"lt3_3_2+dfsg_1","3.3.2+dfsg-1",{"ecosystem":457,"name":447,"vendor":458,"product":447,"cpe_part":9,"purl_type":449,"purl_namespace":458,"purl_name":447,"source":9,"versions":459},"Ubuntu","ubuntu",[460,461],{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":361,"is_range":362,"range_type":363,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":463,"name":438,"vendor":463,"product":438,"cpe_part":9,"purl_type":464,"purl_namespace":9,"purl_name":438,"source":9,"versions":465},"Npm","npm",[466],{"version":467,"is_range":362,"range_type":468,"version_start":9,"version_start_type":9,"version_end":444,"version_end_type":434,"fixed_in":9},"lt3_3_2","semver"]