Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,925

Export CSV
CVE-2026-126945

Zipline before 4.5.1 Stored XSS via HighlightCode Component

Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126946

Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags

Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126954

Glance 0.7.9 before 0.8.8 Stored XSS via Widget-Title-URL Header

Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
Glance Project
Products
Glance
CVE-2026-127084

Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads

Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions.

CVSS 4.0 · 8.5 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127092

BuildAdmin 1.0.1 through 2.3.9 Stored XSS via X-Rewrite-URL in Admin Log

BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascript: URLs in the admin operation log via the X-Rewrite-URL header. When an administrator clicks the log entry's url open button, the script runs in the backend origin and steals the adminInfo token from localStorage, enabling account takeover.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128028

OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128029

OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128040

OpenMage magento-lts before 20.18.2 Stored XSS via Admin Dataflow, Tax, OAuth, PayPal Fields

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.

CVSS 4.0 · 8.4 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128041

OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.

CVSS 4.0 · 8.8 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128051

OpenMage magento-lts before 20.18.2 Stored XSS via Product Name in MSRP Popup

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.

CVSS 4.0 · 4.8 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128053

OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128824

Quay: quay: reflected xss via image_id in v1 registry error responses

A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.

CVSS 3.1 · 5.4 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Mirror Registry Quay
CVE-2026-124004

Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password

XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-124006

Dixell/Copeland XWEB EVO Predictable Root Password Generation

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-124012

Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-125708

WordPress Element Pack Elementor Addons plugin <= 10.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bdthemes Wordpress-extensions
Products
Element Pack Elementor Addons Element Pack Elementor Addons
CVE-2026-40853

Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Xml Graphics Batik
CVE-2026-81557

Authenticated Web Page Injection Allowing Remote File Access in Synology DSMNotify

An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Diskstation Manager
CVE-2026-8333

TimePictra Stored Cross-site Scripting

A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Microchip
Products
Timepictra
CVE-2026-8332

TimePictra root password hardcoded in installation files

A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microchip
Products
Timepictra