Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium

JavaScript Library

DOMPurify

DOMPurify is a DOM-only super-fast uber-tolerant XSS sanitizer for HTML MathML and SVG.

Official Site:

https://cure53.de/purify

Severity Summary:

Critical: 1 High: 2 Medium: 23
Reference
Title
Severity
CVE-2024-48910
DOMPurify Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) Vulnerability
Critical
CVE-2026-47423
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
High
CVE-2026-65898
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
High
CVE-2026-65914
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-65899
DOMPurify Protection Mechanism Failure Vulnerability
Medium
CVE-2026-65900
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-65901
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-65902
DOMPurify Trust Boundary Violation Vulnerability
Medium
CVE-2026-65903
DOMPurify Incorrect Comparison Vulnerability
Medium
CVE-2026-65904
DOMPurify Improper Check for Unusual or Exceptional Conditions Vulnerability
Medium
CVE-2026-65911
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-65912
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-65913
DOMPurify Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) Vulnerability
Medium
CVE-2019-16728
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2020-26870
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-49458
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-49459
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-49978
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-41240
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2025-15599
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2026-0540
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2025-26791
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2024-47875
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium
CVE-2024-45801
DOMPurify Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) Vulnerability
Medium
CVE-2019-25155
DOMPurify URL Redirection to Untrusted Site (Open Redirect) Vulnerability
Medium
CVE-2026-66010
DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Medium