https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:30:58.345035+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T15:30:58.421870+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-341038 EUVD-2026-341038 2026-10-02T15:30:58.421917+00:00 EUVD-2026-341038 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65904 fkie_cve-2026-65904 2026-10-02T15:30:58.421933+00:00

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

 https://cve.radiocsirt.org/vuln/rhsa-2026:54517 RHSA-2026:54517 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T15:30:58.421967+00:00

fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realms DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization. dompurify: DOMPurify: URI validation bypass leads to cross-site scripting dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution browserslist: Browserslist: Prototype pollution leading to denial of service browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65904 UBUNTU-CVE-2026-65904 2026-10-02T15:30:58.422005+00:00

Affected: Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.04:LTS: node-dompurify

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.