https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T10:58:00.959255+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-65903 CVE-2026-65903 — DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS 2026-10-06T10:58:00.960530+00:00

Affected: cure53 DOMPurify

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.