1
CVEs
0
Critical
0
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75838 | IN_PLACE sanitization bypass in DOMPurify before 3.4.13 enables persistent cross-site scripting after sanitize() returns, affecting any application that uses DOMPurify's documented element-removal hook pattern with IN_PLACE mode enabled. When a uponSanitizeElement or beforeSanitizeElements hook removes a node via node.remove(), DOMPurify's _sanitizeElements() exits that node's processing branch without invoking _neutralizeSubtree(), leaving descendant elements - including those carrying browser-queued event handlers such as img onload - outside both the returned DOM and the DOMPurify.removed list. A working proof-of-concept targeting DOMPurify 3.4.12 under Chromium is published in the official GHSA advisory; no active exploitation is confirmed in CISA KEV at time of analysis. | MEDIUM | 5.1 | 0.3% | 26 |
|