Export limit exceeded: 51971 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,971

Export CSV
CVE-2026-90821

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arcadia Technology
Products
Crafty Controller
CVE-2025-6623

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Wso2 Api Control Plane and 5 more
CVE-2026-60043

XSS in backend

An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Helmholz Mb Connect Line
Products
Myrex24v2 Firmware Myrex24v2virtual Mbconnect24 and 1 more
CVE-2026-124603

Hardcoded API Key Discovered in GV-Cloud Android Application v1.5.1

An API key is hardcoded and retrievable from the GV-Cloud application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-cloud Gv-cloud
CVE-2026-124601

Hardcoded API Key Discovered in GV-Access Android Application v1.6.1

An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Geovision Geovision Inc.
Products
Gv-access Gv-access
CVE-2026-110802

Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Altair-graphql Altairgraphql
Products
Altair-express-middleware Altair-fastify-plugin Altair-koa-middleware and 1 more
CVE-2026-125086

D-Link M60 emDaemon MQTT Broker mosquitto.conf system hard-coded credentials

A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
D-link
Products
M60
CVE-2026-125082

sunkaifei FlyCMS Content Rendering detail.html ModelDataService.insertData cross site scripting

A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is named 714521a9262e7bc9ca5713c873f57e96a4845352. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sunkaifei
Products
Flycms
CVE-2026-125112

djust: A template binding inherits a context safety grant it never earned (XSS)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Djust-org
Products
Djust
CVE-2026-125389

Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS Bypass

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Intermesh
Products
Group-office
CVE-2026-75599

HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sysadminsmedia
Products
Homebox
CVE-2026-62345

Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Open-wanderer
Products
Wanderer
CVE-2026-55649

GeoNode has Stored XSS in Documents metadata abstract field

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geonode
Products
Geonode
CVE-2026-124570

SourceCodester Online Leave Management System Employee Avatar Upload Extension Master.php cross site scripting

A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Online Leave Management System
CVE-2026-102615

HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS

HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Heyform
Products
Heyform
CVE-2026-102530

JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Jupyter
Products
Jupyterlab-desktop
CVE-2026-123094

Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Huginn
Products
Huginn
CVE-2026-113369

Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sonatype
Products
Nexus Repository Manager
CVE-2026-111037

Multiple vulnerabilities in Coupa’s Total Spend Management Platform

A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim’s browser. A successful exploit could allow the attacker to perform actions on the victim’s behalf, disclose accessible information or manipulate the user interface.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Coupa
Products
Coupa Total Spend Management Platform