Export limit exceeded: 21016 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 50023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (50023 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93769 | 1 Humhub | 1 Humhub | 2026-09-23 | N/A |
| HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title. | ||||
| CVE-2026-88415 | 2026-09-23 | 8.7 High | ||
| MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter. | ||||
| CVE-2026-95626 | 1 Tauri | 1 Tauri | 2026-09-23 | 8.3 High |
| Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce. | ||||
| CVE-2026-95812 | 2 Clip-bucket, Macwarrior | 2 Clipbucket, Clipbucket-v5 | 2026-09-23 | 6.1 Medium |
| ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin. | ||||
| CVE-2026-10032 | 2 A2ui-project, Google | 2 A2ui, A2ui\/web Core | 2026-09-23 | 6.1 Medium |
| The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default. | ||||
| CVE-2026-47116 | 1 Ltsecurity | 1 Ltk3500sf | 2026-09-23 | 9.8 Critical |
| LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually. | ||||
| CVE-2026-95957 | 1 Sourcecodester | 1 Smart Attendance System With Qr Code Scanner | 2026-09-23 | 4.3 Medium |
| A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file student_signup.php of the component Self-Registration. Performing a manipulation of the argument full_name results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. | ||||
| CVE-2026-92928 | 1 Openeye | 1 Apex Network Video Recorder (nvr) | 2026-09-23 | 6.5 Medium |
| OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4. | ||||
| CVE-2026-88020 | 1 Autonomy Logic | 1 Openplc Runtime | 2026-09-23 | 6.1 Medium |
| Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding. | ||||
| CVE-2026-83801 | 1 Nautobot | 1 Nautobot | 2026-09-23 | 5.4 Medium |
| Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add_relationship or extras.change_relationship permission can store HTML or JavaScript in a Relationship description, and a user with dcim.add_modulefamily or dcim.change_modulefamily permission can store it in a Module Family name. Nautobot assigns these values to form field help_text rendered by render_field.html through Django's |safe filter without adequate neutralization. The stored content executes in the authenticated browser session of any user, including an administrator or superuser, who opens an affected create or edit form. This can enable actions as the victim, session or token theft, and further privilege escalation. This issue is fixed in versions 2.4.37 and 3.1.8. | ||||
| CVE-2026-76909 | 1 Unleash | 1 Unleash | 2026-09-23 | N/A |
| Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3. | ||||
| CVE-2026-5696 | 1 Microweber | 1 Administration Panel | 2026-09-23 | N/A |
| Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session. | ||||
| CVE-2026-12683 | 1 Ankaref Innovation And Technology Inc. | 1 Librid/libref | 2026-09-23 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319. | ||||
| CVE-2026-12682 | 1 Ankaref Innovation And Technology Inc. | 1 Librid/libref | 2026-09-23 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319. | ||||
| CVE-2026-93778 | 2 Jgwhite33, Wordpress | 2 Wp Yelp Review Slider, Wordpress | 2026-09-23 | 7.2 High |
| The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator's ordinary use of the plugin's Download Reviews feature, making the effective attacker unauthenticated. | ||||
| CVE-2026-75744 | 1 Adobe | 2 Aem 6.5 Forms Jee, Aem 6.5 Lts Forms Jee | 2026-09-23 | 8.1 High |
| Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. | ||||
| CVE-2026-39039 | 2026-09-22 | 5.3 Medium | ||
| In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page. | ||||
| CVE-2026-79311 | 1 Webpy | 1 Webpy | 2026-09-22 | 6.1 Medium |
| webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__(). | ||||
| CVE-2026-79315 | 1 Vaxilu | 1 X-ui | 2026-09-22 | 4.7 Medium |
| A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session. | ||||
| CVE-2026-88745 | 2026-09-22 | 6.1 Medium | ||
| EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. | ||||