DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
npm dompurify · Upgrade to 3.4.13 or later · <= 3.4.12 · GHSA-55q2-fjhq-7xh7
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
26–31 of 31 matching · newest first
npm dompurify · Upgrade to 3.4.13 or later · <= 3.4.12 · GHSA-55q2-fjhq-7xh7
Packagist smarty/smarty · Upgrade to 5.8.4 or later · >= 5.0.0, < 5.8.4 · CVE-2026-62996 · GHSA-rjhh-76wf-8xmw · amended
Packagist smarty/smarty · Upgrade to 5.8.2 or 4.5.7 by release line · >= 5.0.0, < 5.8.2; < 4.5.7 · CVE-2026-62992 · GHSA-f6wf-28g6-769x · amended
Packagist craftcms/cms · Upgrade to 5.10.5 or later · >= 5.0.0-RC1, < 5.10.5 · CVE-2026-72780 · GHSA-wg23-69c2-gjc8 · amended
crates.io kuva · Upgrade to 0.4.1 or 0.3.1 by release line · >= 0.1.5, < 0.3.1; >= 0.4.0, < 0.4.1 · GHSA-3c48-9r95-hqhr
PyPI nltk · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-12261 · GHSA-ffj6-66c4-86gw
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.