Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,152

Export CSV
CVE-2026-50229

Apache Tomcat: XSS in number guess example

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CVSS 3.1 · 6.1 Medium EPSS 4.1% KEV · Not listed
Vendors
Apache
Products
Tomcat
CVE-2026-53235

net: add pskb_may_pull() to skb_gro_receive_list()

In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb_gro_receive_list() skb_gro_receive_list() calls skb_pull(skb, skb_gro_offset(skb)) without first ensuring the data is in the linear area via pskb_may_pull(). When the skb arrives via napi_gro_frags(), skb_headlen can be 0 (all data in page fragments) while skb_gro_offset is non-zero (after IP+TCP header parsing). The skb_pull() then decrements skb->len by skb_gro_offset but skb->data_len stays unchanged, hitting BUG_ON(skb->len < skb->data_len) in __skb_pull(). The UDP fraglist GRO path already contains this guard at udp_offload.c:749. Adding it to skb_gro_receive_list() itself provides centralized protection for all callers (TCP, UDP, and any future protocols), and ensures the precondition of skb_pull() is satisfied before it is called. On pskb_may_pull() failure, set NAPI_GRO_CB(skb)->flush = 1 so the skb is not held as a new GRO head and is instead delivered through the normal receive path, matching the UDP handling.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-13314

Stored XSS in pretix-digital

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix-digital
CVE-2026-57534

Stored XSS in pretix-pages

Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix-pages
CVE-2026-57532

XSS in Pretix PDF Editor via Malicious Layout Script

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-13225

Stored XSS in ticket confirmation page

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-57535

Image URL Retrieval via PDF Content Injection Leaks Server Info and Enables SSRF

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-57533

Phishing via Uncontrolled HTML Injection on Redirected Pages

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Pretix
Products
Pretix
CVE-2026-52816

Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability. This vulnerability is fixed in 0.14.3.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gogs
Products
Gogs
CVE-2026-12812

Radware Cyber Controller HTML Report Generation HTML injection

A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects an unknown part of the component HTML Report Generation. The manipulation leads to HTML injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Radware
Products
Cyber Controller
CVE-2026-50146

Astro: Reflected XSS via unescaped slot name

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Astro Withastro
Products
Astro Astro
CVE-2026-54267

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a <script> tag with a predictable identifier. During client bootstrap, Angular recovers this state by looking up the element via document.getElementById('ng-state') and parsing its text content. Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (ng-state), it is susceptible to DOM Clobbering. If the application binds untrusted user input or CMS content to element properties such as id (e.g., <div [id]="userInput"> or <a id="ng-state">) before the genuine <script> tag is parsed by the browser, the attacker-controlled element takes precedence in the DOM lookup. During hydration, when Angular calls document.getElementById('ng-state'), the browser returns the attacker's clobbered element. Angular then attempts to parse the text content or attributes of this clobbered element as JSON. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Angular
Products
Angular
CVE-2025-62198

Apache Atlas: Stored XSS in Create Entity page

An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which fixes the issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Atlas
CVE-2025-71331

Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows

Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src="javascript:alert(document.cookie)">) in a chat box, or by having a custom agent function return an XSS payload from an external website. The injected script executes in the victim's browser, enabling theft of cookies and session data.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Flowiseai
Products
Flowise
CVE-2026-12460

chromium-browser: chromium-browser: Insufficient policy enforcement in File System Access

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: High)

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-48980

pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic

pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mcdope
Products
Pam Usb
CVE-2026-53860

OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles

OpenClaw before 2026.5.7 contains a sender policy bypass vulnerability in BlueBubbles that allows participants to match allowlist entries through conversation metadata rather than stable sender identity. Attackers can influence conversation-level identifiers to receive agent responses intended for configured senders, potentially bypassing access controls.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-12315

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2026-41380

OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables

OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw