[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-65913":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":93,"aliases":94,"duplicate_of":9,"upstream":134,"downstream":137,"duplicates":142,"related":143,"reserved_at":9,"published_at":146,"modified_at":147,"state":148,"summary":149,"references_raw":158,"kevs":206,"epss":207,"epss_history":210,"metrics":385,"affected":409},"CVE-2026-65913","DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-1321","Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","weakness","Incomplete","Variant",[19,67,89],{"id":20,"name":21,"techniques":22},"CAPEC-1","Accessing Functionality Not Properly Constrained by ACLs",[23],{"id":24,"name":25,"tactics":26,"countermeasures":42},"T1574.010","Services File Permissions Weakness",[27,30,33,36,39],{"id":28,"name":29},"TA0110","Persistence",{"id":31,"name":32},"TA0111","Privilege Escalation",{"id":34,"name":35},"TA0030","Defense Evasion",{"id":37,"name":38},"TA0005","Stealth",{"id":40,"name":41},"TA0104","Execution",[43,48,53,58,62],{"id":44,"name":45,"tactic":46},"D3-RS","Restore Software",{"name":47},"Restore",{"id":49,"name":50,"tactic":51},"D3-SWI","Software Inventory",{"name":52},"Model",{"id":54,"name":55,"tactic":56},"D3-SBV","Service Binary Verification",{"name":57},"Detect",{"id":59,"name":60,"tactic":61},"D3-AVE","Asset Vulnerability Enumeration",{"name":52},{"id":63,"name":64,"tactic":65},"D3-SU","Software Update",{"name":66},"Harden",{"id":68,"name":69,"techniques":70},"CAPEC-180","Exploiting Incorrectly Configured Access Control Security Levels",[71],{"id":24,"name":25,"tactics":72,"countermeasures":78},[73,74,75,76,77],{"id":28,"name":29},{"id":31,"name":32},{"id":34,"name":35},{"id":37,"name":38},{"id":40,"name":41},[79,81,83,85,87],{"id":44,"name":45,"tactic":80},{"name":47},{"id":49,"name":50,"tactic":82},{"name":52},{"id":54,"name":55,"tactic":84},{"name":57},{"id":59,"name":60,"tactic":86},{"name":52},{"id":63,"name":64,"tactic":88},{"name":66},{"id":90,"name":91,"techniques":92},"CAPEC-77","Manipulating User-Controlled Variables",[],[],[95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133],"UBUNTU-CVE-2026-65913","DEBIAN-CVE-2026-65913","GHSA-cj63-jhhr-wcxv","CGA-285q-hw33-q25m","CGA-2wmc-9jqr-cm6j","CGA-3gmm-54xr-6729","CGA-3rm8-3wx2-hh27","CGA-43vj-cj5x-3fwj","CGA-4vp2-3fr7-j73m","CGA-5j8j-q9v4-h3vh","CGA-6ch3-hq5h-gvq9","CGA-7cgx-jcqv-j2g9","CGA-7j3p-cj55-g467","CGA-9qq7-wpmp-gj35","CGA-9v86-8cr9-23hw","CGA-c3f9-x54f-j9fc","CGA-cmv9-56f3-jqjv","CGA-cq52-pqmw-rqvq","CGA-fqpm-w5h9-jgfw","CGA-h556-6rc4-qjjp","CGA-hgp9-v645-4rgf","CGA-hpm5-237j-fvv8","CGA-hv3v-2xj3-7c43","CGA-hxfj-v8x4-3p39","CGA-jjx3-jhc3-24mc","CGA-mfcr-3x2p-r99m","CGA-mm5x-3j83-4qrj","CGA-mw7g-6m28-c7w2","CGA-p9p2-86g6-8w8v","CGA-p9vp-8jgf-qr99","CGA-pm54-qwqm-hwp6","CGA-pr93-pqm8-6hp9","CGA-qg4v-24gg-f69f","CGA-qv39-jpg9-j3pp","CGA-qxrv-mhwr-wvgr","CGA-rc9v-4m6v-q3rh","CGA-rm99-wq3f-7xhx","CGA-w72q-p6vp-q2jh","CGA-wph2-x356-h2q2",[135],{"_key":136},"GHSA-CJ63-JHHR-WCXV",[138,140],{"_key":139},"RHSA-2026:58500",{"_key":141},"RHSA-2026:54517",[],[144],{"_key":145},"CGA-432R-MVW3-35V9","2026-07-23T13:16:24.097Z","2026-07-23T13:38:31.668Z","Analyzed",{"cisa_kev":150,"cisa_ransomware":150,"cisa_vendor":9,"epss_severity":151,"epss_score":152,"severity":153,"severity_score":154,"severity_version":155,"severity_source":156,"severity_vector":157,"severity_status":148},false,"low",0.00318,"medium",6.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",[159,172,176,180,184,189,194,198,202],{"url":160,"sources":161,"tags":166},"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv",[156,162,163,164,165],"nvd","osv_ubuntu","osv_npm","osv_chainguard",[167,168,169,170,171],"Vendor Advisory","Third Party Advisory","REPORT","WEB","Advisory",{"url":173,"sources":174,"tags":175},"https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles",[156,162,165],[168,171],{"url":177,"sources":178,"tags":179},"https://ubuntu.com/security/CVE-2026-65913",[163],[169],{"url":181,"sources":182,"tags":183},"https://www.cve.org/CVERecord?id=CVE-2026-65913",[163],[169],{"url":185,"sources":186,"tags":188},"https://security-tracker.debian.org/tracker/CVE-2026-65913",[187],"osv_debian",[171],{"url":190,"sources":191,"tags":192},"https://github.com/cure53/DOMPurify",[164],[193],"PACKAGE",{"url":195,"sources":196,"tags":197},"https://github.com/cure53/DOMPurify/releases/tag/3.3.2",[164],[170],{"url":199,"sources":200,"tags":201},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65913.json",[165],[171],{"url":203,"sources":204,"tags":205},"https://nvd.nist.gov/vuln/detail/CVE-2026-65913",[165],[171],[],{"date":208,"score":152,"percentile":209},"2026-09-19",0.24924,[211,215,218,221,224,227,231,234,237,240,243,246,249,252,255,258,261,264,267,270,273,276,279,282,285,288,291,294,297,300,303,306,309,312,315,318,321,324,327,330,333,336,339,342,345,348,351,354,357,360,363,366,369,372,375,378,381,384],{"date":212,"score":213,"percentile":214},"2026-07-24",0.00178,0.07542,{"date":216,"score":213,"percentile":217},"2026-07-25",0.07546,{"date":219,"score":213,"percentile":220},"2026-07-26",0.07583,{"date":222,"score":213,"percentile":223},"2026-07-27",0.07571,{"date":225,"score":213,"percentile":226},"2026-07-28",0.07617,{"date":228,"score":229,"percentile":230},"2026-07-29",0.00185,0.08373,{"date":232,"score":229,"percentile":233},"2026-07-30",0.0837,{"date":235,"score":229,"percentile":236},"2026-07-31",0.08375,{"date":238,"score":229,"percentile":239},"2026-08-01",0.08363,{"date":241,"score":229,"percentile":242},"2026-08-02",0.08337,{"date":244,"score":229,"percentile":245},"2026-08-03",0.08329,{"date":247,"score":229,"percentile":248},"2026-08-04",0.08309,{"date":250,"score":229,"percentile":251},"2026-08-05",0.08281,{"date":253,"score":229,"percentile":254},"2026-08-06",0.08265,{"date":256,"score":229,"percentile":257},"2026-08-07",0.08256,{"date":259,"score":229,"percentile":260},"2026-08-08",0.08254,{"date":262,"score":229,"percentile":263},"2026-08-09",0.08246,{"date":265,"score":229,"percentile":266},"2026-08-10",0.08253,{"date":268,"score":229,"percentile":269},"2026-08-11",0.08303,{"date":271,"score":229,"percentile":272},"2026-08-12",0.08313,{"date":274,"score":229,"percentile":275},"2026-08-13",0.08307,{"date":277,"score":229,"percentile":278},"2026-08-14",0.08316,{"date":280,"score":229,"percentile":281},"2026-08-15",0.08343,{"date":283,"score":229,"percentile":284},"2026-08-16",0.08371,{"date":286,"score":229,"percentile":287},"2026-08-17",0.0838,{"date":289,"score":229,"percentile":290},"2026-08-18",0.08377,{"date":292,"score":229,"percentile":293},"2026-08-19",0.08413,{"date":295,"score":229,"percentile":296},"2026-08-20",0.08411,{"date":298,"score":229,"percentile":299},"2026-08-21",0.0839,{"date":301,"score":229,"percentile":302},"2026-08-22",0.08392,{"date":304,"score":229,"percentile":305},"2026-08-23",0.08358,{"date":307,"score":152,"percentile":308},"2026-08-24",0.23949,{"date":310,"score":152,"percentile":311},"2026-08-25",0.2397,{"date":313,"score":152,"percentile":314},"2026-08-26",0.24042,{"date":316,"score":152,"percentile":317},"2026-08-27",0.24061,{"date":319,"score":152,"percentile":320},"2026-08-28",0.2405,{"date":322,"score":152,"percentile":323},"2026-08-29",0.24079,{"date":325,"score":152,"percentile":326},"2026-08-30",0.24146,{"date":328,"score":152,"percentile":329},"2026-08-31",0.24144,{"date":331,"score":152,"percentile":332},"2026-09-01",0.24167,{"date":334,"score":152,"percentile":335},"2026-09-02",0.24195,{"date":337,"score":152,"percentile":338},"2026-09-03",0.24215,{"date":340,"score":152,"percentile":341},"2026-09-04",0.24244,{"date":343,"score":152,"percentile":344},"2026-09-05",0.24241,{"date":346,"score":152,"percentile":347},"2026-09-06",0.2431,{"date":349,"score":152,"percentile":350},"2026-09-07",0.24309,{"date":352,"score":152,"percentile":353},"2026-09-08",0.24322,{"date":355,"score":152,"percentile":356},"2026-09-09",0.2445,{"date":358,"score":152,"percentile":359},"2026-09-10",0.2446,{"date":361,"score":152,"percentile":362},"2026-09-11",0.24444,{"date":364,"score":152,"percentile":365},"2026-09-12",0.2455,{"date":367,"score":152,"percentile":368},"2026-09-13",0.24508,{"date":370,"score":152,"percentile":371},"2026-09-14",0.24527,{"date":373,"score":152,"percentile":374},"2026-09-15",0.24598,{"date":376,"score":152,"percentile":377},"2026-09-16",0.24711,{"date":379,"score":152,"percentile":380},"2026-09-17",0.24764,{"date":382,"score":152,"percentile":383},"2026-09-18",0.24915,{"date":208,"score":152,"percentile":209},[386,394,398,401,403,407],{"source":156,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":387,"cvss_v4_0":391},{"baseScore":154,"baseSeverity":388,"vectorString":157,"impactScore":389,"exploitabilityScore":390},"MEDIUM",4.5,7.2,{"baseScore":392,"baseSeverity":388,"vectorString":393,"impactScore":9,"exploitabilityScore":9},5.1,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",{"source":162,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":395,"cvss_v4_0":396},{"baseScore":154,"baseSeverity":388,"vectorString":157,"impactScore":389,"exploitabilityScore":390},{"baseScore":392,"baseSeverity":388,"vectorString":397,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":163,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":399,"cvss_v4_0":400},{"baseScore":154,"baseSeverity":9,"vectorString":157,"impactScore":389,"exploitabilityScore":390},{"baseScore":392,"baseSeverity":9,"vectorString":393,"impactScore":9,"exploitabilityScore":9},{"source":187,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":402,"cvss_v4_0":9},{"baseScore":154,"baseSeverity":9,"vectorString":157,"impactScore":389,"exploitabilityScore":390},{"source":164,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":404},{"baseScore":405,"baseSeverity":9,"vectorString":406,"impactScore":9,"exploitabilityScore":9},5.3,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",{"source":165,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":408},{"baseScore":392,"baseSeverity":9,"vectorString":393,"impactScore":9,"exploitabilityScore":9},[410,420,424,428,432,436,440,444,448,452,456,460,464,468,472,476,480,484,491,501,512,518],{"ecosystem":411,"name":412,"vendor":413,"product":412,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":412,"source":9,"versions":415},"Chainguard","airflow-2","chainguard","apk",[416],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"ecosystem":411,"name":421,"vendor":413,"product":421,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":421,"source":9,"versions":422},"airflow-core-2",[423],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":425,"vendor":413,"product":425,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":425,"source":9,"versions":426},"gitlab-rails-ce-18.1",[427],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":429,"vendor":413,"product":429,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":429,"source":9,"versions":430},"gitlab-rails-ce-18.5",[431],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":433,"vendor":413,"product":433,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":433,"source":9,"versions":434},"gitlab-rails-ce-18.6",[435],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":437,"vendor":413,"product":437,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":437,"source":9,"versions":438},"gitlab-rails-ce-18.7",[439],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":441,"vendor":413,"product":441,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":441,"source":9,"versions":442},"gitlab-rails-ce-18.8",[443],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":445,"vendor":413,"product":445,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":445,"source":9,"versions":446},"gitlab-rails-ce-18.9",[447],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":449,"vendor":413,"product":449,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":449,"source":9,"versions":450},"gitlab-rails-ce-fips-18.1",[451],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":453,"vendor":413,"product":453,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":453,"source":9,"versions":454},"gitlab-rails-ce-fips-18.5",[455],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":457,"vendor":413,"product":457,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":457,"source":9,"versions":458},"gitlab-rails-ce-fips-18.6",[459],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":461,"vendor":413,"product":461,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":461,"source":9,"versions":462},"gitlab-rails-ce-fips-18.7",[463],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":465,"vendor":413,"product":465,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":465,"source":9,"versions":466},"gitlab-rails-ce-fips-18.8",[467],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":469,"vendor":413,"product":469,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":469,"source":9,"versions":470},"gitlab-rails-ce-fips-18.9",[471],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":473,"vendor":413,"product":473,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":473,"source":9,"versions":474},"langfuse-fips-3.152",[475],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":477,"vendor":413,"product":477,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":477,"source":9,"versions":478},"langfuse-fips-3.152-worker",[479],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":481,"vendor":413,"product":481,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":481,"source":9,"versions":482},"nextcloud-server-31",[483],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":411,"name":485,"vendor":413,"product":485,"cpe_part":9,"purl_type":414,"purl_namespace":413,"purl_name":485,"source":9,"versions":486},"wazuh-dashboard-plugins",[487],{"version":488,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":489,"version_end_type":490,"fixed_in":9},"lt4_14_4_r1","4.14.4-r1","excluding",{"ecosystem":9,"name":492,"vendor":493,"product":494,"cpe_part":495,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":496},"DOMPurify","cure53","dompurify","a",[497],{"version":498,"is_range":418,"range_type":499,"version_start":9,"version_start_type":9,"version_end":500,"version_end_type":490,"fixed_in":9},"lt3.3.2","cpe","3.3.2",{"ecosystem":502,"name":503,"vendor":504,"product":503,"cpe_part":9,"purl_type":505,"purl_namespace":504,"purl_name":503,"source":9,"versions":506},"Debian","node-dompurify","debian","deb",[507,508,509],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":510,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":511,"version_end_type":490,"fixed_in":9},"lt3_3_2+dfsg_1","3.3.2+dfsg-1",{"ecosystem":513,"name":503,"vendor":514,"product":503,"cpe_part":9,"purl_type":505,"purl_namespace":514,"purl_name":503,"source":9,"versions":515},"Ubuntu","ubuntu",[516,517],{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":417,"is_range":418,"range_type":419,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":519,"name":494,"vendor":519,"product":494,"cpe_part":9,"purl_type":520,"purl_namespace":9,"purl_name":494,"source":9,"versions":521},"Npm","npm",[522],{"version":523,"is_range":418,"range_type":524,"version_start":9,"version_start_type":9,"version_end":500,"version_end_type":490,"fixed_in":9},"lt3_3_2","semver"]