CVE-2026-77643 | Medium | 4.4 | 2026-08-20 | A cross-site scripting vulnerability in
queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HT… |
CVE-2026-55491 | Medium | 5.4 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/inde… |
CVE-2026-54505 | | | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into j… |
CVE-2026-49436 | High | 7.3 | 2026-08-20 | LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without… |
CVE-2026-49245 | Low | 3.7 | 2026-08-20 | SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authent… |
CVE-2026-77506 | Medium | 4.8 | 2026-08-20 | Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS. |
CVE-2026-68921 | Medium | 4.7 | 2026-08-20 | DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute witho… |
CVE-2026-75526 | Medium | 4.4 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_plac… |
CVE-2026-50190 | | | 2026-08-20 | Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListControlle… |
CVE-2026-73259 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using… |
CVE-2026-73254 | Medium | 5.4 | 2026-08-20 | Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cr… |
CVE-2026-49825 | High | 8.2 | 2026-08-20 | lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:hre… |
CVE-2026-64972 | | | 2026-08-20 | ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break o… |
CVE-2026-64971 | | | 2026-08-20 | ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScr… |
CVE-2026-64970 | | | 2026-08-20 | ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in th… |
CVE-2026-77072 | | | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied it… |
CVE-2026-73402 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions. |
CVE-2026-68564 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions. |
CVE-2026-66673 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions. |
CVE-2026-66616 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions. |
CVE-2026-66615 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions. |
CVE-2026-66614 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions. |
CVE-2026-66612 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions. |
CVE-2026-66611 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions. |
CVE-2026-66607 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions. |
CVE-2026-66606 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions. |
CVE-2026-66605 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions. |
CVE-2026-66604 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions. |
CVE-2026-66601 | Medium | 6.5 | 2026-08-20 | Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions. |
CVE-2026-66598 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions. |
CVE-2026-66597 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions. |
CVE-2026-66590 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. |
CVE-2026-66582 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions. |
CVE-2026-66581 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. |
CVE-2026-76569 | | | 2026-08-20 | Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4 |
CVE-2026-76565 | | | 2026-08-20 | Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7 |
CVE-2026-76564 | | | 2026-08-20 | Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7 |
CVE-2026-75948 | | | 2026-08-20 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fie… |
CVE-2026-71368 | Medium | 6.1 | 2026-08-20 | F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be p… |
CVE-2026-74992 | Medium | 6.8 | 2026-08-20 | The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove… |
CVE-2026-19697 | Medium | 6.8 | 2026-08-20 | The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload cap… |
CVE-2026-19615 | Medium | 6.8 | 2026-08-20 | The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users… |
CVE-2026-76367 | Medium | 4.0 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of a… |
CVE-2026-76346 | Medium | 5.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sp… |
CVE-2026-76333 | High | 7.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action… |
CVE-2026-76326 | Medium | 5.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard vi… |
CVE-2026-76325 | High | 7.3 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge obje… |
CVE-2026-76324 | Medium | 5.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and c… |
CVE-2026-76318 | Medium | 5.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious sc… |
CVE-2026-76252 | Medium | 6.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page coul… |
CVE-2026-54743 | | | 2026-08-19 | Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post… |
CVE-2026-68900 | High | 7.6 | 2026-08-19 | Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textCo… |
CVE-2026-67189 | Medium | 6.1 | 2026-08-19 | pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR… |
CVE-2026-55090 | | | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditiona… |
CVE-2026-55087 | Medium | 6.1 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/expre… |
CVE-2026-55085 | Critical | 9.6 | 2026-08-19 | Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list… |
CVE-2026-61807 | | | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-sele… |
CVE-2026-64851 | | | 2026-08-19 | Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav S… |
CVE-2026-61607 | Medium | 4.6 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media… |
CVE-2026-18430 | | | 2026-08-19 | HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's c… |
CVE-2026-75955 | | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XM… |
CVE-2026-54793 | Medium | 4.6 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabi… |
CVE-2026-40508 | Medium | 5.4 | 2026-08-19 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers wit… |
CVE-2026-40507 | Medium | 6.1 | 2026-08-19 | OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is r… |
CVE-2026-18756 | | | 2026-08-19 | HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacke… |
CVE-2026-18526 | | | 2026-08-19 | HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow. |
CVE-2026-75917 | High | 8.6 | 2026-08-19 | SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/move… |
CVE-2026-75916 | High | 8.6 | 2026-08-19 | SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/h… |
CVE-2026-73354 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions. |
CVE-2026-73184 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions. |
CVE-2026-73182 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions. |
CVE-2026-66596 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions. |
CVE-2026-61986 | High | 7.1 | 2026-08-19 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions. |
CVE-2026-18372 | | | 2026-08-19 | CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user inte… |
CVE-2026-18371 | | | 2026-08-19 | HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users. |
CVE-2026-75981 | High | 7.2 | 2026-08-19 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in vers… |
CVE-2026-15780 | High | 7.2 | 2026-08-19 | The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campai… |
CVE-2026-15446 | Medium | 6.4 | 2026-08-19 | The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all version… |
CVE-2026-19056 | High | 7.1 | 2026-08-19 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its adm… |
CVE-2026-19055 | High | 7.1 | 2026-08-19 | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its pub… |
CVE-2026-18202 | Medium | 6.8 | 2026-08-19 | The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with t… |
CVE-2026-16617 | High | 8.8 | 2026-08-19 | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, a… |
CVE-2026-16570 | High | 7.1 | 2026-08-19 | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its a… |
CVE-2026-15253 | Medium | 6.8 | 2026-08-19 | The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media l… |
CVE-2026-14334 | High | 8.8 | 2026-08-19 | The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attack… |
CVE-2026-14287 | Medium | 4.7 | 2026-08-19 | The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacke… |
CVE-2026-66358 | Medium | 6.1 | 2026-08-19 | A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script. |
CVE-2026-15421 | Medium | 6.4 | 2026-08-19 | The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in… |
CVE-2026-66591 | Medium | 6.5 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS.
… |
CVE-2026-27365 | Medium | 5.9 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS.
This… |
CVE-2026-66603 | Medium | 6.5 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored X… |
CVE-2026-52873 | Medium | 6.9 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC han… |
CVE-2026-52854 | High | 8.6 | 2026-08-18 | Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser func… |
CVE-2026-54347 | High | 8.7 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain… |
CVE-2026-41921 | Medium | 5.4 | 2026-08-18 | Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated… |
CVE-2025-9211 | Medium | 6.7 | 2026-08-18 | Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalat… |
CVE-2026-61696 | Medium | 6.3 | 2026-08-18 | Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through… |
CVE-2026-52609 | Medium | 6.1 | 2026-08-18 | A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a… |
CVE-2026-73336 | | | 2026-08-18 | Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org mar… |
CVE-2026-52606 | Medium | 6.1 | 2026-08-18 | A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a… |