Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 51987 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,987

Export CSV
CVE-2026-113691

Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113695

Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc It Service Management Suite
CVE-2026-113697

Reflected Cross-Site Scripting in BMC Helix Operations Management

Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bmc
Products
Bmc Helix Operations Management
CVE-2026-107308

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Country
CVE-2026-107306

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Menu Link Attributes
CVE-2026-107265

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Leaflet
CVE-2026-107252

MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Mathjax: Latex For Drupal
CVE-2026-85268

Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Google Cloud
Products
Identity Platform And Firebase Authentication
CVE-2026-119662

Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Songloft-org
Products
Songloft
CVE-2026-96379

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Cookiecuttr
CVE-2026-114555

Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Data Field
CVE-2026-48164

Collabora Online: Reflected HTML injection through host_session_id

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the `host_session_id` query/form parameter is substituted into the `cool.html` editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective `Content Security Policy`, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the `Content Security Policy` header sent by `coolwsd` mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Collaboraoffice
Products
Online
CVE-2026-114127

Astro: Arbitrary CSS injection in Astro View Transitions

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application that passes attacker-controlled data into properties such as duration, delay, easing, direction, fillMode, or animation names can allow CSS delimiters to terminate the declaration and add attacker-selected rules to the server-rendered page. The generated stylesheet still escapes literal less-than characters, so the injected content cannot terminate the style element or directly inject HTML or JavaScript. The injected CSS can conceal or reposition content, add generated text, and otherwise misrepresent the interface; some applications may also expose data already present in selectable DOM attributes through conditional resource loads. This issue is fixed in 7.3.3.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Astro Withastro
Products
Astro Astro
CVE-2026-114655

KMS request injection via unsanitized key vault and provider values in libmongocrypt

libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Libmongocrypt
CVE-2026-102918

Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Davidanderson Wordpress-extensions
Products
Redux Framework Redux Framework
CVE-2026-27061

WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—