Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,985

Export CSV
CVE-2026-88801

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-110813

Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-87099

Cross‑Site Scripting in Acronis Cyber Protect 17 Due to Improper Input Validation

Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

CVSS 3.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Acronis
Products
Acronis Cyber Protect 17
CVE-2026-67073

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Aex
CVE-2026-63399

Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the `GraphQL` API. This issue is fixed in version 1.0.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Roostorg
Products
Coop
CVE-2026-120242

Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting

A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ruijie
Products
Rg-es205gc Rg-es206gc-p Rg-es208gc and 2 more
CVE-2026-120218

Typemill SvgSanitizer.php saveImage cross site scripting

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 2.27.0 is sufficient to resolve this issue. This patch is called 9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Typemill
Products
Typemill
CVE-2026-120190

PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting

A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the component Submission Description Editor. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.1.76 addresses this issue. The patch is identified as 6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4. It is advisable to upgrade the affected component.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Postybirb Plus
Products
Postybirb Plus
CVE-2026-102790

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Icagenda.com
Products
Icagenda Extension For Joomla
CVE-2025-5769

Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification

The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Identity Server and 3 more
CVE-2023-38375

IBM Cloud Pak System Cross-Site Scripting

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak System
CVE-2026-3295

IBM Cloud Pak System Cross-Site Scripting

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak System
CVE-2026-97635

Agent Zero Web UI XSS

The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Agent-zero
Products
Agent-zero
CVE-2026-7003

WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wit
Products
Synapps Runtime
CVE-2026-114536

USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Uswds Paragraph Components
CVE-2026-114534

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Block Attributes
CVE-2026-114532

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Ui Icons
CVE-2026-110738

Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Gin Admin Theme
CVE-2026-107889

Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Red Hat Single Sign On and 1 more
CVE-2026-107260

Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Sector Distribution