Search: CVE-2026-75838

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.1	EPSS 0.4%	CVE-2026-75838cure53 DOMPurify · Cross-site Scripting Medium5.1EPSS 0.4%2026-08-18CVE Database V5CVE-2026-75838 DOMPurify versions before 3.4.13 contain a cross-site scripting (XSS) vulnerability in the IN_PLACE sanitization method. The vulnerability arises because element-removal hooks fail to neutralize detached subtrees, allowing attackers to inject HTML with event handlers on descendant elements that execute after sanitization. This occurs even though the returned root element appears clean after sanitization. EPSS 0.4%Vulnerability	CVE Database V5	2026-08-18

Page 1 of 1 · 2 duplicate CVE records merged