Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,971

Export CSV
CVE-2026-46856

Unauthenticated HTTP Exploit Allows Platform Takeover in Oracle Enterprise Manager Base Platform

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Enterprise Manager Base Platform
CVE-2026-72727

Discourse: Stored XSS in the moderation review queue

Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Discourse
Products
Discourse
CVE-2026-73357

WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nexcess Wordpress
Products
Givewp Wordpress
CVE-2026-66449

WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dylan Kuhn Wordpress
Products
Geo Mashup Wordpress
CVE-2026-73295

Material for MkDocs: DOM XSS in search suggestions via query parameter

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Squidfunk
Products
Mkdocs-material
CVE-2026-73628

Serendipity 2.3.5 Reflected XSS via search clean-URL route

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
S9y
Products
Serendipity
CVE-2026-28170

WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Meril Wordpress
Products
Blog Floating Button Wordpress
CVE-2026-19716

Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Maalfer
Products
Pentestify
CVE-2026-73427

Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Basecamp
Products
Trix