Export limit exceeded: 51985 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,985

Export CSV
CVE-2026-39379

GeoNetwork: Reflected XSS through client-side template injection

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-113274

chromium-browser: chromium-browser: Use after free in ReadingMode

Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2025-64537

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page that are executed in the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that a victim must visit a crafted malicious page.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Experience Manager
CVE-2025-4439

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-116836

Stored XSS Vulnerability in Ubiquiti airMAX M Allowing Privilege Escalation

A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ubiquiti
Products
Airmax M
CVE-2026-121652

Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl. To remediate this issue, users should upgrade to 4.0.3 or later.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Maplibre-gl-js-amplify
CVE-2026-55409

Filament: Disabled RichEditor field state can be used for XSS

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Filamentphp
Products
Filament
CVE-2026-121551

PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Postfixadmin Project
Products
Postfixadmin
CVE-2026-121440

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bytecodealliance
Products
Wasmtime
CVE-2026-120575

Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed on every admin page via localized script data due to a commented-out screen-condition guard.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-120524

News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen accessible to Subscribers (such as /wp-admin/profile.php), and because sanitize_text_field() is applied to the raw JSON string before json_decode(), allowing angle brackets encoded as \u003c/\u003e to survive sanitization and be restored to literal angle brackets, enabling overwrite of _elementor_data on any post.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-120332

Cross-Site Scripting in extension "Mail" (mail)

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Typo3
Products
Extension Mail
CVE-2026-119736

Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Petpooja
Products
Munshi
CVE-2026-111048

FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Fossbilling
Products
Fossbilling
CVE-2026-121578

CVE-2026-121578

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Amidaware
Products
Tactical Rmm
CVE-2026-61719

WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Labredescefetrj
Products
Wegia
CVE-2026-116823

YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() falls back to unsanitized $_REQUEST values rendered via Twig |raw templates, performing same-origin authenticated actions in victims' sessions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yeswiki
Products
Yeswiki
CVE-2023-54413

WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-59107

Shared SSH Authentication Key in vSolution Matrix File Sharing

A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Wolfvision
Products
Cynap Cynap Pro