# Cure53 vulnerabilities Source: https://junglewise.ai/threats/vendors/cure53 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 31 October 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/cure53.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 38 vulnerabilities in Cure53: 3 in the last 7 days and 11 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116804, was published on 27 October 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. 1 technology has a page of its own. ## Counts - Last 7 days: 3 - Last 30 days: 9 - Last 90 days: 11 - All time: 38 (1 critical, 0 exploited in the wild) ## About Cure53 German cybersecurity firm specializing in security audits, penetration testing, and vulnerability research. ## Latest Cure53 vulnerabilities - [CVE-2026-116804: DOMPurify SAFE_FOR_TEMPLATES bypass via shadow root content](https://junglewise.ai/threats/cve-2026-116804-dompurify-from-3-4-4-before-3-4-17-contains-a-safe-for-templates) (medium, CVSS 6.1, published 27 Oct 2026) - [CVE-2026-116803: DOMPurify DOM XSS in IN_PLACE hook-detached subtrees](https://junglewise.ai/threats/cve-2026-116803-dompurify-before-3-4-17-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 27 Oct 2026) - [CVE-2026-116802: DOMPurify cross-site scripting in SMIL attributeName guard bypass](https://junglewise.ai/threats/cve-2026-116802-dompurify-before-3-4-17-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 27 Oct 2026) - [DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content](https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf) (critical, CVSS 4, published 22 Oct 2026) - [DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling](https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f) (high, CVSS 4, published 22 Oct 2026) - [DOMPurify SMIL attributeName=href guard bypass in XHTML mode](https://junglewise.ai/threats/dompurify-smil-attributename-href-guard-is-skipped-when-parser-media-15a5efd2) (low, published 22 Oct 2026) - [CVE-2026-109345: DOMPurify cross-site scripting in IN_PLACE mode sanitization](https://junglewise.ai/threats/cve-2026-109345-dompurify-before-3-4-16-contains-a-cross-site-scripting) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2026-109344: DOMPurify cross-site scripting in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/cve-2026-109344-dompurify-from-3-4-13-before-3-4-16-contains-a-cross-site) (medium, CVSS 6.1, published 12 Oct 2026) - [DOMPurify IN_PLACE mode XSS via rawtext element text content](https://junglewise.ai/threats/dompurify-in-place-returns-a-force-removed-rawtext-root-whose-text-16d9ac9e) (info, published 5 Oct 2026) - [DOMPurify DOM XSS in IN_PLACE mode with afterSanitize hooks](https://junglewise.ai/threats/dompurify-in-place-node-removing-aftersanitize-hook-leaves-detached-3087e7fd) (medium, CVSS 4, published 30 Sep 2026) - [CVE-2026-75838: DOMPurify IN_PLACE hook removal XSS via detached subtree](https://junglewise.ai/threats/cve-2026-75838-dompurify-in-place-hook-removal-xss-via-detached-subtree) (medium, CVSS 4, published 18 Aug 2026) - [CVE-2026-66010: DOMPurify hook bypass in CUSTOM_ELEMENT_HANDLING](https://junglewise.ai/threats/cve-2026-66010-dompurify-hook-bypass-in-custom-element-handling) (medium, CVSS 6.1, published 24 Jul 2026) - [CVE-2026-65914: cure53 DOMPurify mutation-XSS via Re-Contextualization](https://junglewise.ai/threats/cve-2026-65914-cure53-dompurify-mutation-xss-via-re-contextualization) (medium, CVSS 4, published 23 Jul 2026) - [CVE-2026-65913: cure53 DOMPurify prototype pollution in USE_PROFILES mode](https://junglewise.ai/threats/cve-2026-65913-cure53-dompurify-prototype-pollution-in-use-profiles-mode) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65912: cure53 DOMPurify URI validation bypass in attributeCheck](https://junglewise.ai/threats/cve-2026-65912-cure53-dompurify-uri-validation-bypass-in-attributecheck) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65911: Cure53 DOMPurify XSS via state leakage in ADD_ATTR and ADD_TAGS](https://junglewise.ai/threats/cve-2026-65911-cure53-dompurify-xss-via-state-leakage-in-add-attr-and-add-tags) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65904: cure53 DOMPurify XSS bypass in IN_PLACE mode via cross-realm nodes](https://junglewise.ai/threats/cve-2026-65904-cure53-dompurify-xss-bypass-in-in-place-mode-via-cross-realm) (medium, CVSS 4.7, published 23 Jul 2026) - [CVE-2026-65903: cure53 DOMPurify logic error in ADD_TAGS function bypasses FORBID_TAGS](https://junglewise.ai/threats/cve-2026-65903-cure53-dompurify-logic-error-in-add-tags-function-bypasses-forbid) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65902: cure53 DOMPurify global allow-list pollution via hook mutation](https://junglewise.ai/threats/cve-2026-65902-cure53-dompurify-global-allow-list-pollution-via-hook-mutation) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65901: cure53 DOMPurify XSS in IN_PLACE mode via nodeName clobbering](https://junglewise.ai/threats/cve-2026-65901-cure53-dompurify-xss-in-in-place-mode-via-nodename-clobbering) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65900: cure53 DOMPurify template expression bypass in DOM output modes](https://junglewise.ai/threats/cve-2026-65900-cure53-dompurify-template-expression-bypass-in-dom-output-modes) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65899: cure53 DOMPurify state contamination in Trusted Types policy](https://junglewise.ai/threats/cve-2026-65899-cure53-dompurify-state-contamination-in-trusted-types-policy) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-65898: cure53 DOMPurify allowlist pollution via setConfig](https://junglewise.ai/threats/cve-2026-65898-cure53-dompurify-allowlist-pollution-via-setconfig) (high, CVSS 7.2, published 23 Jul 2026) - [CVE-2026-49978: Cure53 DOMPurify XSS bypass in IN_PLACE sanitization](https://junglewise.ai/threats/cve-2026-49978-cure53-dompurify-xss-bypass-in-in-place-sanitization) (medium, CVSS 4, published 14 Jul 2026) - [CVE-2026-49459: cure53 DOMPurify XSS via DOM Clobbering in IN_PLACE mode](https://junglewise.ai/threats/cve-2026-49459-cure53-dompurify-xss-via-dom-clobbering-in-in-place-mode) (medium, CVSS 6.1, published 14 Jul 2026) ## Most severe Cure53 vulnerabilities - [DOMPurify SAFE_FOR_TEMPLATES bypass in shadow root content](https://junglewise.ai/threats/dompurify-safe-for-templates-bypass-split-template-expressions-survive-c23665cf) (critical, CVSS 4, published 22 Oct 2026) - [CVE-2026-47423: cure53 DOMPurify XSS bypass via selectedcontent re-cloning](https://junglewise.ai/threats/cve-2026-47423-cure53-dompurify-xss-bypass-via-selectedcontent-re-cloning) (high, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-65898: cure53 DOMPurify allowlist pollution via setConfig](https://junglewise.ai/threats/cve-2026-65898-cure53-dompurify-allowlist-pollution-via-setconfig) (high, CVSS 7.2, published 23 Jul 2026) - [DOMPurify IN_PLACE event handler bypass when hook removes parent or sibling](https://junglewise.ai/threats/dompurify-in-place-hook-that-removes-a-parent-or-sibling-leaves-the-3ea5d18f) (high, CVSS 4, published 22 Oct 2026) - [CVE-2026-41238: DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback](https://junglewise.ai/threats/cve-2026-41238-dompurify-prototype-pollution-to-xss-bypass-via-custom-element) (medium, CVSS 6.9, published 23 Apr 2026) - [CVE-2026-41239: DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode](https://junglewise.ai/threats/cve-2026-41239-dompurify-has-a-safe-for-templates-bypass-in-return-dom-mode) (medium, CVSS 6.8, published 23 Apr 2026) - [CVE-2026-65899: cure53 DOMPurify state contamination in Trusted Types policy](https://junglewise.ai/threats/cve-2026-65899-cure53-dompurify-state-contamination-in-trusted-types-policy) (medium, CVSS 6.1, published 23 Jul 2026) - [CVE-2026-49458: cure53 DOMPurify XSS via cross-realm bypass in IN_PLACE mode](https://junglewise.ai/threats/cve-2026-49458-cure53-dompurify-xss-via-cross-realm-bypass-in-in-place-mode) (medium, CVSS 6.1, published 14 Jul 2026) - [CVE-2026-49459: cure53 DOMPurify XSS via DOM Clobbering in IN_PLACE mode](https://junglewise.ai/threats/cve-2026-49459-cure53-dompurify-xss-via-dom-clobbering-in-in-place-mode) (medium, CVSS 6.1, published 14 Jul 2026) - [CVE-2026-65902: cure53 DOMPurify global allow-list pollution via hook mutation](https://junglewise.ai/threats/cve-2026-65902-cure53-dompurify-global-allow-list-pollution-via-hook-mutation) (medium, CVSS 6.1, published 23 Jul 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 3 Aug 2026 | 0 | 0 | 0 | | 10 Aug 2026 | 0 | 0 | 0 | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 3 | 1 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | ## Cure53 technologies - [Cure53 DOMPurify](https://junglewise.ai/threats/technologies/cure53-dompurify): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Cure53 vulnerabilities", https://junglewise.ai/threats/vendors/cure53, 31 October 2026.