Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

cure53 — Vulnerabilities & Security Advisories 29

Browse all 29 CVE security advisories affecting cure53. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Cure53 operates as an independent security consultancy specializing in application and network penetration testing, with a focus on identifying critical vulnerabilities in web applications, APIs, and enterprise systems. Historically, they have commonly discovered remote code execution, cross-site scripting, and privilege escalation flaws, contributing to their 10 CVE records. The firm is known for thorough manual testing methodologies and has been involved in high-profile assessments for major organizations. While no major security incidents directly involving cure53 have been widely reported, their work has consistently uncovered significant vulnerabilities that could lead to system compromises, data breaches, or unauthorized access if left unaddressed.

Top products by cure53: DOMPurify
CVE ID Title CVSS Severity Published
CVE-2026-109345 DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root — DOMPurify CWE-79 6.1 Medium 2026-10-12
CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks — DOMPurify CWE-79 6.1 Medium 2026-10-12
CVE-2026-75838 DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook — DOMPurify CWE-79 5.1 Medium 2026-08-18
CVE-2026-66010 DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING — DOMPurify CWE-79 6.1 Medium 2026-07-24
CVE-2026-65914 DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization — DOMPurify CWE-79 5.3 Medium 2026-07-23
CVE-2026-65913 DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES — DOMPurify CWE-1321 6.1 Medium 2026-07-23
CVE-2026-65911 DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage — DOMPurify CWE-79 6.1 Medium 2026-07-23
CVE-2026-65912 DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR — DOMPurify CWE-79 6.1 Medium 2026-07-23
CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode — DOMPurify CWE-754 4.7 Medium 2026-07-23
CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags — DOMPurify CWE-501 6.1 Medium 2026-07-23
CVE-2026-65903 DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS — DOMPurify CWE-697 6.1 Medium 2026-07-23
CVE-2026-65901 DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName — DOMPurify CWE-79 6.1 Medium 2026-07-23
CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM — DOMPurify CWE-79 6.1 Medium 2026-07-23
CVE-2026-65899 DOMPurify before 3.4.9 Trusted Types Policy State Contamination — DOMPurify CWE-693 6.1 Medium 2026-07-23
CVE-2026-65898 DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig — DOMPurify CWE-79 7.2 High 2026-07-23
CVE-2026-49978 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content — DOMPurify CWE-79 - - 2026-07-14
CVE-2026-49459 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM — DOMPurify CWE-79 6.1 Medium 2026-07-14
CVE-2026-49458 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks — DOMPurify CWE-79 6.1 Medium 2026-07-14
CVE-2026-47423 DOMPurify XSS via `selectedcontent` re-clone — DOMPurify CWE-79 8.2 High 2026-07-14
CVE-2026-41240 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) — DOMPurify CWE-183 7.2AI High AI 2026-04-23
CVE-2026-41239 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode — DOMPurify CWE-79 6.8 Medium 2026-04-23
CVE-2026-41238 DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback — DOMPurify CWE-79 6.9 Medium 2026-04-23
CVE-2026-0540 DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML — DOMPurify CWE-79 6.1 Medium 2026-03-03
CVE-2025-15599 DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML — DOMPurify CWE-79 6.1 Medium 2026-03-03
CVE-2025-48050 DOMPurify 安全漏洞 — DOMPurify CWE-24 7.5 High 2025-05-15
CVE-2025-26791 DOMPurify 安全漏洞 — DOMPurify CWE-79 4.5 Medium 2025-02-14
CVE-2024-48910 DOMPurify vulnerable to tampering by prototype polution — DOMPurify CWE-1321 9.1 Critical 2024-10-31
CVE-2024-47875 DOMPurify nesting-based mXSS — DOMPurify CWE-79 10.0 Critical 2024-10-11
CVE-2024-45801 Tampering by prototype polution in DOMPurify — DOMPurify CWE-1333 7.3 High 2024-09-16

This page lists every published CVE security advisory associated with cure53. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.