Export limit exceeded: 51970 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,970

Export CSV
CVE-2025-59180

Use of Hard-coded Credentials Vulnerability

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ericsson
Products
Packet Core Controller
CVE-2026-66390

Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Wicket
CVE-2026-59239

Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Roskus
Products
Prospero Flow Crm
CVE-2026-14827

Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Calendar Wordpress
Products
Calendar Wordpress
CVE-2026-57396

WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flintop Wordpress
Products
Free Gifts For Woocommerce Wordpress
CVE-2026-12496

Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Loytec
Products
L-dali L-gate L-inx and 5 more
CVE-2026-65764

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Commander Extension For Joomla
CVE-2026-44752

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Netweaver Application Server Java(configuration Wizard)
CVE-2026-58475

Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dan-in-ca
Products
Sip Sustainable Irrigation Platform