CVE-2026-66010: Cross-Site Scripting (XSS) via custom element attribute bypass

Medium [CVE-2026-66010] Cross-Site Scripting (XSS) via custom element attribute bypass

CVE-2026-66010Source published Jul 24, 2026Source updated Jul 24, 2026

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets. A flaw was found in DOMPurify. These attributes can then be re-injected into web page content, leading to Cross-Site Scripting (XSS) attacks. An attacker could exploit this to execute malicious scripts in a user's browser, potentially leading to information disclosure or unauthorized actions. This Moderate-impact flaw in DOMPurify allows for Cross-Site Scripting (XSS) attacks by enabling the bypass of sanitization policies for custom elements. An…

Affected products in this advisory

• Cryostat 4
• Migration Toolkit for Virtualization
• Multicluster Engine for Kubernetes
• Node HealthCheck Operator

30 more entries in the full advisory.

Source-reported affected versions

• < 3.4.12

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Critical [CVE-2025-61726 +30] Third-Party Package Updates in Splunk Enterprise - October 2026

SVD-2026-1009Source published Oct 21, 2026

This bulletin covers 31 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher. Affected products named by the advisory: Splunk Enterprise 10.4; Splunk Enterprise 10.2; Splunk Enterprise 10.0; Splunk Enterprise 9.4.

Affected products in this advisory

• Splunk Enterprise 10.4
• Splunk Enterprise 10.2
• Splunk Enterprise 10.0
• Splunk Enterprise 9.4

Source-reported affected versions

• Splunk Enterprise 10.4.0 to 10.4.3
• Splunk Enterprise 10.2.0 to 10.2.7
• Splunk Enterprise 10.0.0 to 10.0.10
• Splunk Enterprise 9.4.0 to 9.4.15

Source-reported fixed versions

• Splunk Enterprise 10.4.4
• Splunk Enterprise 10.2.8
• Splunk Enterprise 10.0.11
• Splunk Enterprise 9.4.16

Mitigation guidance

• Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.