CVE-2026-103585 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows… |
CVE-2026-103584 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension all… |
CVE-2026-103445 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows S… |
CVE-2026-103439 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cros… |
CVE-2026-103438 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows… |
CVE-2026-103437 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows… |
CVE-2026-103444 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows St… |
CVE-2026-103443 | | | 2026-09-30 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension a… |
CVE-2026-27085 | Low | 2.7 | 2026-09-30 | Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions. |
CVE-2026-102279 | Low | 3.1 | 2026-09-28 | Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tip… |
CVE-2026-63216 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, unsanitized option labels are rendered in the configuration dialogs of AI A… |
CVE-2026-57440 | High | 7.5 | 2026-09-24 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video… |
CVE-2026-91130 | | | 2026-09-22 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/cha… |
CVE-2026-68919 | | | 2026-09-21 | GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic th… |
CVE-2026-52741 | | | 2026-09-21 | GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenie… |
CVE-2026-12751 | Medium | 5.4 | 2026-09-15 | IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed… |
CVE-2026-54503 | Medium | 4.3 | 2026-09-15 | plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, dep… |
CVE-2026-52774 | Medium | 6.1 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_… |
CVE-2026-52773 | Medium | 6.1 | 2026-09-05 | YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hi… |
CVE-2026-32773 | Medium | 6.1 | 2026-09-02 | There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code whi… |
CVE-2026-82838 | | | 2026-08-31 | The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A val… |
CVE-2026-55696 | Medium | 4.3 | 2026-08-28 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses ge… |
CVE-2026-5218 | Medium | 4.3 | 2026-08-27 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce… |
CVE-2026-5389 | Medium | 6.1 | 2026-08-23 | justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. At… |
CVE-2026-35163 | | | 2026-08-21 | OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rende… |
CVE-2026-73220 | | | 2026-08-20 | CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in c… |
CVE-2026-20232 | Medium | 5.4 | 2026-08-19 | A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to c… |
CVE-2026-52854 | High | 8.6 | 2026-08-18 | Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser func… |
CVE-2026-54570 | Medium | 6.9 | 2026-08-18 | AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnota… |
CVE-2026-75872 | | | 2026-08-18 | HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message… |
CVE-2026-75082 | Medium | 4.3 | 2026-08-18 | A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Regis… |
CVE-2026-19988 | Medium | 4.3 | 2026-08-17 | A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component… |
CVE-2026-73238 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in code display in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, whic… |
CVE-2026-73237 | Medium | 6.1 | 2026-08-12 | XSS vulnerability in Markdown handling in Apache Allura.
This issue affects Apache Allura: from 1.10.0 before 1.19.1.
Users are recommended to upgrade to ver… |
CVE-2026-65841 | | | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SV… |
CVE-2026-34497 | Medium | 5.4 | 2026-07-31 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting… |
CVE-2026-48910 | Medium | 6.5 | 2026-07-30 | A carefully crafted editing request could trigger an XSS vulnerability
on Apache JSPWiki when parsing errors on the markdown renderer, which
could allow the… |
CVE-2024-58355 | High | 8.9 | 2026-07-23 | Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/bookin… |
CVE-2024-58353 | High | 8.9 | 2026-07-23 | Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /bo… |
CVE-2026-32822 | Medium | 6.1 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-54443 | | | 2026-07-15 | Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link… |
CVE-2026-59838 | Medium | 5.9 | 2026-07-15 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, Forti… |
CVE-2026-57167 | | | 2026-07-10 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON… |
CVE-2026-59855 | | | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path va… |
CVE-2026-7380 | Medium | 6.1 | 2026-07-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (… |
CVE-2025-36321 | Medium | 5.7 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2026-50229 | Medium | 6.1 | 2026-06-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
This issue affects… |
CVE-2025-64637 | Medium | 5.3 | 2026-06-26 | Unauthenticated Content Injection in Auros Core <= 5.3.1 versions. |
CVE-2026-57535 | | | 2026-06-25 | Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src
attribute of these images pointed to a… |
CVE-2026-57534 | | | 2026-06-25 | Malicious HTML content could be injected into the content of a page in the pretix-pages plugin. |
CVE-2026-57533 | | | 2026-06-25 | Malicious HTML content could be injected into the page pretix shows when
redirection to an untrusted page occurs. Since this page has a
Content-Security-Poli… |
CVE-2026-57532 | | | 2026-06-25 | Malicious HTML content contained in the layout specification of a PDF
ticket or badge layout was executed when the PDF editor is opened in the
browser. This… |
CVE-2026-13314 | | | 2026-06-25 | Malicious HTML content could be injected into the content rendered by the pretix-digital plugin. |
CVE-2026-13225 | | | 2026-06-25 | Malicious HTML content could be injected into the email address of an
order, which pretix showed without sanitization on the confirmation page
for individual… |
CVE-2026-52816 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary… |
CVE-2026-50146 | High | 7.1 | 2026-06-22 | Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute wit… |
CVE-2025-62198 | Medium | 5.4 | 2026-06-22 | An authenticated user can perform XSS.
This issue affects Apache Atlas versions 2.4.0 and earlier.
Users are recommended to upgrade to version 2.5.0, which f… |
CVE-2026-12812 | Low | 3.5 | 2026-06-21 | A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects an unknown part of the component HTML Report Generation. The… |
CVE-2025-71331 | Medium | 6.1 | 2026-06-20 | Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An… |
CVE-2026-46492 | High | 7.2 | 2026-06-09 | md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the applic… |
CVE-2026-34033 | Medium | 5.4 | 2026-06-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0… |
CVE-2026-11511 | Low | 3.5 | 2026-06-08 | A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the componen… |
CVE-2026-9646 | Medium | 6.1 | 2026-05-28 | A reflected cross-site scripting issue exists in URL handling. |
CVE-2026-44839 | Medium | 4.8 | 2026-05-27 | RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13. |
CVE-2026-39642 | Medium | 5.3 | 2026-05-26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection.
This issue affects Nyla: f… |
CVE-2025-71310 | | | 2026-05-26 | The GDPR cookies module for Backdrop CMS (before
1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has be… |
CVE-2026-34246 | Medium | 4.8 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in t… |
CVE-2026-45346 | Medium | 5.4 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerabili… |
CVE-2025-15345 | Medium | 6.1 | 2026-05-14 | The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in… |
CVE-2026-44369 | | | 2026-05-13 | CVAT is an open source interactive video and image annotation tool for computer vision. From 2.5.0 to 2.63.0, an attacker who is able to create or edit an anno… |
CVE-2026-44259 | Medium | 4.6 | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without an… |
CVE-2026-41611 | High | 7.8 | 2026-05-12 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. |
CVE-2026-43939 | High | 7.3 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post… |
CVE-2026-43938 | High | 8.1 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNET.Core/Logger/DbLogger.cs) captures the… |
CVE-2021-47948 | Medium | 5.4 | 2026-05-10 | WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Hel… |
CVE-2026-42451 | Medium | 6.3 | 2026-05-08 | Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory's browser-based EPUB reader al… |
CVE-2026-42030 | Medium | 6.1 | 2026-05-08 | MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS ser… |
CVE-2026-41575 | Medium | 6.1 | 2026-05-08 | In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting (XSS) vulnerability was identified in an IP Reputation Checker appli… |
CVE-2026-44264 | Medium | 4.3 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly… |
CVE-2026-6002 | High | 8.8 | 2026-05-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross… |
CVE-2025-59854 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, wh… |
CVE-2026-40875 | | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections"… |
CVE-2026-40873 | | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment fil… |
CVE-2026-40872 | | | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the… |
CVE-2026-1564 | Medium | 4.8 | 2026-04-15 | Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with… |
CVE-2026-20170 | Medium | 6.1 | 2026-04-15 | A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to conduct cross-site s… |
CVE-2026-40105 | Medium | 6.1 | 2026-04-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, th… |
CVE-2026-39425 | Medium | 5.4 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability that allows authenticat… |
CVE-2026-26460 | Medium | 6.1 | 2026-04-13 | A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabi… |
CVE-2026-33657 | Medium | 4.6 | 2026-04-13 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any aut… |
CVE-2026-39941 | Medium | 6.1 | 2026-04-09 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parame… |
CVE-2026-34718 | Medium | 6.1 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitiz… |
CVE-2026-39712 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This is… |
CVE-2026-39629 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affect… |
CVE-2026-39628 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issu… |
CVE-2026-39626 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affe… |
CVE-2026-39625 | Medium | 5.3 | 2026-04-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affe… |
CVE-2026-39841 | Medium | 6.1 | 2026-04-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored X… |
CVE-2026-39839 | Medium | 6.1 | 2026-04-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored X… |
CVE-2026-39837 | Medium | 5.4 | 2026-04-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This iss… |