https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:57:34.969312+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1049 certfr-2026-avi-1049 — De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Certaines d'entre elles permettent à un attaquant de… 2026-10-02T14:57:35.048319+00:00 certfr-2026-avi-1049 https://cve.radiocsirt.org/vuln/cleanstart-2026-bb38451 CLEANSTART-2026-BB38451 — Security fix for CVE-2026-65898 applied in: langfuse-worker 3.194.1-r1 2026-10-02T14:57:35.048362+00:00

Affected: CleanStart: langfuse-worker

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-340157 EUVD-2026-340157 2026-10-02T14:57:35.048393+00:00 EUVD-2026-340157 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65898 fkie_cve-2026-65898 2026-10-02T14:57:35.048406+00:00

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

 https://cve.radiocsirt.org/vuln/ghsa-cmwh-pvxp-8882 GHSA-cmwh-pvxp-8882 — DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3… 2026-10-02T14:57:35.048430+00:00

Affected: npm: dompurify

## Summary

DOMPurify 3.4.7 shipped a security fix ("permanent hook pollution") that makes a registered `uponSanitizeAttribute` hook's mutation of `data.allowedAttributes` **non-persistent** — so allowing an attribute for one element does not leak into later `sanitize()` calls. The fix clones `ALLOWED_ATTR` inside `_parseConfig`.

That guard is **silently bypassed whenever the application uses the persistent-config API `DOMPurify.setConfig()`.** `setConfig()` sets the module flag `SET_CONFIG = true`, which causes `sanitize()` to **skip `_parseConfig` entirely** — and the clone-guard lives inside `_parseConfig`. The hook is then handed the **live, shared `ALLOWED_ATTR` object**; any `data.allowedAttributes[name] = true` it writes mutates that shared object **permanently**, for the lifetime of the DOMPurify instance, across every subsequent call, and across **all** elements.

If an application uses `setConfig()` together with an `uponSanitizeAttribute` hook that conditionally allows a dangerous attribute (`onerror`, `onclick`, `onmouseover`, `srcdoc`, `formaction`, …) for "trusted" elements, then **one trusted render permanently allows that attribute on untrusted, attacker-controlled content** — yielding stored XSS in viewers' browsers. DOMPurify applies no separate `/^on/` event-handler blocklist: attribute stripping is governed entirely by the allowlist, so a polluted allowlist is the only gate, and survival in the output is final.

---

## Affected configuration (preconditi…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11723-1 openSUSE-SU-2026:11723-1 — python313-comfyui-frontend-package-1.52.7-1.1 on GA media 2026-10-02T14:57:35.048539+00:00

python313-comfyui-frontend-package-1.52.7-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:58500 RHSA-2026:58500 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T14:57:35.048559+00:00

dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName dompurify: DOMPurify: Sanitization bypass via hook manipulation DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization. dompurify: DOMPurify: URI validation bypass leads to cross-site scripting dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65898 UBUNTU-CVE-2026-65898 2026-10-02T14:57:35.048587+00:00

Affected: Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.04:LTS: node-dompurify

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.