Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-65903

CVE-2026-65903: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium6.1

    Medium [CVE-2026-65903] Security bypass allows injection of malicious content

    CVE-2026-65903Source published Source updated

    DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output. A flaw was found in DOMPurify. By crafting specific input, an attacker can cause tags that should be removed to remain in the sanitized output. This could lead to the injection of malicious content, potentially compromising the integrity of web pages. This Moderate flaw in DOMPurify allows an attacker to bypass content sanitization by crafting specific input, leading to the injection of malicious content. Exploitation requires user interaction, as an attacker must trick a user…

    Affected products in this advisory
    • Cryostat 4
    • Migration Toolkit for Virtualization
    • Multicluster Engine for Kubernetes
    • Node HealthCheck Operator

    30 more entries in the full advisory.

    Source-reported affected versions
    • < 3.4.0
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features