Export limit exceeded: 51971 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,971

Export CSV
CVE-2026-75719

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager Experience Manager Cloud Service
CVE-2026-75730

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager
CVE-2026-75706

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager Experience Manager Cloud Service
CVE-2026-75734

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager Experience Manager Cloud Service
CVE-2026-71565

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager Experience Manager Cloud Service
CVE-2026-75678

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager Experience Manager Cloud Service
CVE-2026-71357

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager Experience Manager Cloud Service
CVE-2026-97286

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Strong Testimonials Strong Testimonials
CVE-2026-97289

WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Expresstech Wordpress-extensions
Products
Quiz And Survey Master Quiz And Survey Master
CVE-2026-109697

WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Surecart Surecart
CVE-2026-109810

CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-120016

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-67177

Chargemap stored XSS

Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-67175

Chargemap stored XSS

Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114229

Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Ofbiz Apache Ofbiz
CVE-2026-124435

OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload

OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Openremote
Products
Core Openremote
CVE-2026-88986

Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Kubeflow
Products
Pipelines