Export limit exceeded: 425852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 51980 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,980

Export CSV
CVE-2026-73537

WebView Cross‑Site Scripting in Miraikan Assist App

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running on the affected product, resulting in the displayed content being altered.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Japan Science And Technology Agency (jst)
Products
Miraikan Assist App Android Version Miraikan Assist App Ios Version
CVE-2026-14325

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drag And Drop Multiple File Uploader Pro - Contact Form 7 Project Wordpress
Products
Drag And Drop Multiple File Uploader Pro - Contact Form 7 Wordpress
CVE-2026-17209

IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Mirror For I
CVE-2026-55090

Etherpad: Stored XSS in HTML export via unescaped attribute-pool values

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Etherpad
Products
Etherpad
CVE-2026-75091

Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mdmag Wordpress
Products
Quill Forms | Conversational Multi Step Forms, Surveys & Quizzes Wordpress
CVE-2026-75626

SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Smicallef
Products
Spiderfoot
CVE-2026-19447

Stored XSS in Fileorbis Informatics's FileOrbis

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fileorbis
Products
Fileorbis
CVE-2026-73338

WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Autopay Wordpress
Products
Autopay Wordpress
CVE-2026-73342

WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Magazine3 Wordpress
Products
Wp Multilang Wordpress
CVE-2025-9211

Cross-site scripting in Otalio Ship Property Management System

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Otalio
Products
Ship Property Management System
CVE-2026-52854

mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Professionalwiki
Products
Maps