CWE-79 · Cross-site Scripting (page 21)
Page 21 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73422 | | 2026-08-12 | Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properti… | |
CVE-2026-73415 | | 2026-08-12 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in p… | |
CVE-2026-73329 | High | 8.7 | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administr… |
CVE-2026-72787 | Medium | 6.4 | 2026-08-12 | Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding… |
CVE-2026-49466 | Medium | 6.5 | 2026-08-12 | Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the… |
CVE-2026-19657 | Medium | 6.1 | 2026-08-12 | ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafte… |
CVE-2026-18099 | High | 8.9 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled inp… |
CVE-2026-15217 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-15216 | High | 8.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain co… |
CVE-2026-16627 | High | 7.7 | 2026-08-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated… |
CVE-2026-73295 | Medium | 5.4 | 2026-08-12 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/asse… |
CVE-2026-48552 | Medium | 5.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflecte… |
CVE-2026-48550 | Medium | 6.1 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthentic… |
CVE-2026-16694 | Medium | 6.4 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code i… |
CVE-2026-65937 | High | 8.0 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content. |
CVE-2026-73374 | | 2026-08-12 | A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associat… | |
CVE-2026-73262 | Medium | 5.4 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, asse… |
CVE-2026-57858 | High | 8.9 | 2026-08-12 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticat… |
CVE-2026-70560 | Medium | 5.4 | 2026-08-12 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inje… |
CVE-2026-19217 | Medium | 5.4 | 2026-08-12 | The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could… |
CVE-2026-17013 | Medium | 6.1 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which cou… |
CVE-2026-16066 | Medium | 5.4 | 2026-08-12 | The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users wi… |
CVE-2026-15249 | Medium | 5.4 | 2026-08-12 | The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a… |
CVE-2026-9318 | Medium | 5.4 | 2026-08-12 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScr… |
CVE-2026-73031 | High | 8.7 | 2026-08-11 | telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sendi… |
CVE-2026-66146 | Medium | 6.1 | 2026-08-11 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute… |
CVE-2026-48414 | High | 7.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-48413 | High | 8.7 | 2026-08-11 | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts i… |
CVE-2026-73084 | Medium | 6.1 | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query… |
CVE-2026-71386 | High | 8.8 | 2026-08-11 | is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could e… |
CVE-2026-70355 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate pr… |
CVE-2026-70306 | Critical | 9.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-65767 | High | 8.8 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform sp… |
CVE-2026-64922 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64916 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64902 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64900 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-64897 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-62914 | High | 7.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoo… |
CVE-2026-62829 | Medium | 4.6 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-57105 | High | 8.0 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-57104 | High | 8.8 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privi… |
CVE-2026-21269 | Medium | 4.6 | 2026-08-11 | ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into… |
CVE-2026-18247 | | 2026-08-11 | A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute… | |
CVE-2026-72925 | Medium | 6.1 | 2026-08-11 | SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processin… |
CVE-2026-19434 | | 2026-08-11 | Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application o… | |
CVE-2026-72747 | High | 7.2 | 2026-08-11 | AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the datab… |
CVE-2026-72559 | Medium | 5.4 | 2026-08-11 | A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsed… |
CVE-2026-72553 | Medium | 5.4 | 2026-08-11 | A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cu… |
CVE-2026-73161 | | 2026-08-11 | Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previousl… | |
CVE-2026-73159 | | 2026-08-11 | Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously… | |
CVE-2026-73158 | | 2026-08-11 | Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later con… | |
CVE-2026-73157 | | 2026-08-11 | Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields s… | |
CVE-2026-73156 | | 2026-08-11 | Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may orig… | |
CVE-2026-16974 | Medium | 6.4 | 2026-08-11 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode i… |
CVE-2026-66779 | Medium | 6.3 | 2026-08-11 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make… |
CVE-2026-66771 | Medium | 6.1 | 2026-08-11 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequent… |
CVE-2026-72743 | Medium | 5.4 | 2026-08-10 | SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE out… |
CVE-2026-69116 | Medium | 6.1 | 2026-08-10 | FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts… |
CVE-2026-44401 | Medium | 4.8 | 2026-08-10 | Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-c… |
CVE-2026-72730 | High | 8.7 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username… |
CVE-2026-72729 | | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-d… | |
CVE-2026-72727 | | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the m… | |
CVE-2026-56619 | Medium | 5.4 | 2026-08-10 | HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input. |
CVE-2026-72725 | Medium | 5.4 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inje… |
CVE-2026-72720 | Medium | 6.4 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.forma… |
CVE-2026-72751 | | 2026-08-10 | CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content. Atta… | |
CVE-2026-63105 | Medium | 5.4 | 2026-08-10 | ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads th… |
CVE-2026-18478 | | 2026-08-10 | Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded… | |
CVE-2026-72594 | High | 7.6 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScrip… |
CVE-2026-72583 | Medium | 5.4 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing mal… |
CVE-2026-72576 | Medium | 5.4 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript… |
CVE-2026-72570 | Medium | 5.4 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web int… |
CVE-2026-57279 | Medium | 6.8 | 2026-08-10 | Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a us… |
CVE-2026-17019 | Medium | 6.1 | 2026-08-10 | The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can u… |
CVE-2026-17010 | Medium | 5.4 | 2026-08-10 | The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with con… |
CVE-2026-15047 | Medium | 6.8 | 2026-08-10 | The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing user… |
CVE-2026-14293 | High | 8.8 | 2026-08-10 | The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not esc… |
CVE-2026-13701 | Medium | 4.8 | 2026-08-10 | The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which coul… |
CVE-2026-19378 | Medium | 4.3 | 2026-08-10 | A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipu… |
CVE-2026-16032 | Medium | 6.1 | 2026-08-09 | The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and… |
CVE-2026-71502 | | 2026-08-08 | CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-render… | |
CVE-2026-16559 | Medium | 6.8 | 2026-08-08 | The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-priv… |
CVE-2026-16558 | Medium | 5.4 | 2026-08-08 | The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not ver… |
CVE-2026-16535 | Medium | 6.1 | 2026-08-08 | The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attac… |
CVE-2026-18988 | Medium | 6.4 | 2026-08-08 | The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and includi… |
CVE-2026-48026 | High | 8.7 | 2026-08-07 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the… |
CVE-2026-11425 | Medium | 4.4 | 2026-08-07 | Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject ar… |
CVE-2026-62293 | Medium | 5.0 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates… |
CVE-2026-19230 | Low | 3.5 | 2026-08-07 | A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the c… |
CVE-2026-64638 | | 2026-08-07 | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an at… | |
CVE-2026-17596 | Medium | 6.1 | 2026-08-07 | Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permissi… |
CVE-2026-48093 | Medium | 6.5 | 2026-08-07 | The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post conten… |
CVE-2026-19209 | Low | 3.5 | 2026-08-07 | A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This mani… |
CVE-2026-19207 | Low | 2.4 | 2026-08-07 | A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-… |
CVE-2026-66494 | | 2026-08-07 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious… | |
CVE-2026-48094 | | 2026-08-07 | The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping… | |
CVE-2026-54216 | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link includ… | |
CVE-2026-15386 | Medium | 5.4 | 2026-08-07 | The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked… |
CVE-2026-15245 | Medium | 5.4 | 2026-08-07 | The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline s… |