WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-79✕
Overview 49,693 matches · 1,166 in Waratek scope · 30 protected · 345 exploited · 32 CISA KEV · 3,312 public PoC · 214 EPSS ≥ 0.5
49,693matches 1,166in Waratek scope2.3% 30protected0.1% 345exploited0.7% 32CISA KEV0.1% 3,312public PoC6.7% 214EPSS ≥ 0.50.4%
Protected by Waratek 30 0.1% Rule in development 1 0.0% Mitigation candidate 74 0.1% No exploit published 1,061 2.1% Outside Waratek scope 398 0.8% Not applicable 48,125 96.8% Withdrawn CVE 4 0.0%
Critical 804 1.6% High 6,117 12.3% Medium 40,436 81.4% Low 2,292 4.6% None 33 0.1% Unknown 11 0.0%
blocked by ARMR today 30 0.1% partly blocked 0 0.0% not blocked 49,663 99.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 345 0.7% Working exploit published 3,123 6.3% Proof of concept only 6,694 13.5% Forecast only 107 0.2% No public exploit 39,424 79.3%
split by peak 8,496 / year
Withdrawn CVE: 4Not applicable: 48,125Outside Waratek scope: 398No exploit published: 1,061Mitigation candidate: 74Rule in development: 1Protected by Waratek: 30 Unknown: 11None: 33Low: 2,292Medium: 40,436High: 6,117Critical: 804 not blocked: 49,663blocked by ARMR today: 30 No public exploit: 39,424Forecast only: 107Proof of concept only: 6,694Working exploit published: 3,123Exploited: 345
20001 Not applicable1 Medium1 not blocked1 No public exploit1 20010 200234 No exploit published1 Not applicable33 Medium34 not blocked34 Working exploit published18 No public exploit16 200336 Mitigation candidate1 No exploit published1 Outside Waratek scope1 Not applicable33 Medium36 not blocked36 Working exploit published18 No public exploit18 200424 Not applicable24 High1 Medium23 not blocked24 Working exploit published11 No public exploit13 200543 No exploit published2 Outside Waratek scope1 Not applicable40 Medium40 Low3 not blocked43 Working exploit published16 Forecast only1 No public exploit26 2006126 Protected by Waratek1 Mitigation candidate2 No exploit published2 Not applicable121 Medium113 Low13 blocked by ARMR today1 not blocked125 Exploited1 Working exploit published45 No public exploit80 2007359 Mitigation candidate4 No exploit published6 Outside Waratek scope1 Not applicable347 Withdrawn CVE1 Critical1 High2 Medium333 Low22 Unknown1 not blocked359 Exploited1 Working exploit published131 No public exploit227 2008791 Mitigation candidate6 No exploit published9 Outside Waratek scope2 Not applicable774 High1 Medium738 Low52 not blocked791 Exploited1 Working exploit published329 Proof of concept only1 Forecast only1 No public exploit459 2009822 Protected by Waratek1 Mitigation candidate4 No exploit published11 Not applicable806 Medium750 Low72 blocked by ARMR today1 not blocked821 Exploited2 Working exploit published361 No public exploit459 2010594 Protected by Waratek1 Mitigation candidate4 No exploit published12 Not applicable577 Medium525 Low69 blocked by ARMR today1 not blocked593 Exploited3 Working exploit published181 No public exploit410 2011459 Mitigation candidate1 No exploit published8 Outside Waratek scope1 Not applicable449 Medium422 Low37 not blocked459 Exploited4 Working exploit published121 Proof of concept only1 No public exploit333 2012729 Mitigation candidate2 No exploit published11 Not applicable716 High1 Medium614 Low114 not blocked729 Exploited4 Working exploit published195 No public exploit530 2013617 Mitigation candidate2 No exploit published25 Outside Waratek scope2 Not applicable588 Medium479 Low138 not blocked617 Exploited5 Working exploit published77 Forecast only1 No public exploit534 20141,027 Protected by Waratek2 No exploit published17 Outside Waratek scope18 Not applicable990 High4 Medium813 Low210 blocked by ARMR today2 not blocked1,025 Exploited5 Working exploit published126 Forecast only1 No public exploit895 2015726 No exploit published10 Outside Waratek scope13 Not applicable703 Medium535 Low191 not blocked726 Exploited3 Working exploit published74 Proof of concept only1 Forecast only1 No public exploit647 2016474 Mitigation candidate1 No exploit published22 Outside Waratek scope18 Not applicable433 High8 Medium464 Low2 not blocked474 Exploited4 Working exploit published40 No public exploit430 20171,477 Protected by Waratek3 Mitigation candidate1 No exploit published41 Outside Waratek scope43 Not applicable1,389 Critical3 High15 Medium1,458 Low1 blocked by ARMR today3 not blocked1,474 Exploited4 Working exploit published94 Proof of concept only2 Forecast only1 No public exploit1,376 20182,021 Mitigation candidate2 No exploit published46 Outside Waratek scope36 Not applicable1,937 Critical6 High36 Medium1,978 Low1 not blocked2,021 Exploited6 Working exploit published201 Proof of concept only9 Forecast only5 No public exploit1,800 20192,343 Protected by Waratek2 Mitigation candidate10 No exploit published64 Outside Waratek scope28 Not applicable2,239 Critical24 High38 Medium2,280 Low1 blocked by ARMR today2 not blocked2,341 Exploited10 Working exploit published196 Proof of concept only6 Forecast only3 No public exploit2,128 20202,168 Protected by Waratek2 Mitigation candidate9 No exploit published104 Outside Waratek scope50 Not applicable2,003 Critical46 High97 Medium2,022 Low3 blocked by ARMR today2 not blocked2,166 Exploited23 Working exploit published128 Proof of concept only4 Forecast only6 No public exploit2,007 20212,686 Mitigation candidate3 No exploit published68 Outside Waratek scope39 Not applicable2,576 Critical50 High134 Medium2,502 not blocked2,686 Exploited27 Working exploit published183 Proof of concept only37 Forecast only26 No public exploit2,413 20223,240 Protected by Waratek12 Mitigation candidate2 No exploit published164 Outside Waratek scope35 Not applicable3,027 Critical77 High150 Medium3,001 Low10 Unknown2 blocked by ARMR today12 not blocked3,228 Exploited33 Working exploit published198 Proof of concept only377 Forecast only30 No public exploit2,602 20234,730 Protected by Waratek4 Mitigation candidate11 No exploit published133 Outside Waratek scope22 Not applicable4,560 Critical114 High608 Medium4,002 Low6 blocked by ARMR today4 not blocked4,726 Exploited23 Working exploit published170 Proof of concept only1,040 Forecast only21 No public exploit3,476 20247,371 Protected by Waratek1 Mitigation candidate1 No exploit published84 Outside Waratek scope32 Not applicable7,253 Critical127 High1,061 Medium6,109 Low74 blocked by ARMR today1 not blocked7,370 Exploited87 Working exploit published51 Proof of concept only1,514 Forecast only7 No public exploit5,712 20258,299 Protected by Waratek1 Rule in development1 Mitigation candidate5 No exploit published115 Outside Waratek scope40 Not applicable8,134 Withdrawn CVE3 Critical86 High1,666 Medium5,964 Low579 None1 Unknown3 blocked by ARMR today1 not blocked8,298 Exploited25 Working exploit published108 Proof of concept only1,907 Forecast only3 No public exploit6,256 20268,496 Mitigation candidate3 No exploit published105 Outside Waratek scope16 Not applicable8,372 Critical270 High2,295 Medium5,200 Low694 None32 Unknown5 not blocked8,496 Exploited74 Working exploit published51 Proof of concept only1,795 No public exploit6,576
200220052008201120142017202020232026
49,693 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 497 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-104718 Medium 2026-11-11 Not applicable No public exploit The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication.
CVE-2025-59848 Medium 2026-11-11 Not applicable No public exploit HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session
CVE-2025-59847 Medium 2026-11-11 Not applicable No public exploit HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session
CVE-2025-15714 Low 2026-11-11 Not applicable No public exploit The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).
CVE-2025-15713 Low 2026-11-11 Not applicable No public exploit The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups.
CVE-2025-15712 Low 2026-11-11 Not applicable No public exploit The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).
CVE-2025-15711 Low 2026-11-11 Not applicable No public exploit The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups).
CVE-2026-93427 High 2026-11-10 Not applicable No public exploit The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-84938 High 2026-11-10 Not applicable No public exploit The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Fusion Form is embedded on an admin-authored page (granting manage_options context to the Dynamic Data action hook callback), and that a Post Cards element configured to display attachment post types is present on a publicly accessible page so the planted shortcode payload is rendered.
CVE-2026-80095 Critical 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-67177 Medium 2026-11-10 Not applicable Proof of concept only Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in the username field of the account registration page and associate the new account with a victim's email. The attacker could send a forgotten password request to the victim, and the payload would execute when a victim opens the link. Fixed 2026-07-17.
CVE-2026-67175 Medium 2026-11-10 Not applicable Proof of concept only Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malicious payload in the user profile page that executes when another user views the attacker's profile. Fixed 2026-07-17.
CVE-2026-63010 High 2026-11-10 Not applicable No public exploit Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33.
CVE-2026-60043 Medium 2026-11-10 Not applicable No public exploit An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
CVE-2026-26248 High 2026-11-10 Not applicable No public exploit A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests.
CVE-2026-126079 Medium 2026-11-10 Not applicable No public exploit Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
CVE-2026-126078 Medium 2026-11-10 Not applicable No public exploit Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the <a href="search?q=\1"> form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default <mark>\1</mark> highlighter and the block form are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
CVE-2026-126075 Medium 2026-11-10 Not applicable No public exploit Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected. This issue is fixed in version 8.1.4.1.
CVE-2026-126070 Medium 2026-11-10 Not applicable No public exploit Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
CVE-2026-126069 Medium 2026-11-10 Not applicable No public exploit Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, the fix for CVE-2026-33168 skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as :" ", is not blank, because Symbol#blank? is Symbol#empty?, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as image_tag, video_tag and audio_tag, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
CVE-2026-126063 Low 2026-11-10 Not applicable No public exploit Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.
CVE-2026-125878 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.
CVE-2026-12574 High 2026-11-10 Not applicable No public exploit Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
CVE-2026-125395 Medium 2026-11-10 Not applicable No public exploit Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.
CVE-2026-125392 Medium 2026-11-10 Not applicable No public exploit Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.
CVE-2026-125389 Medium 2026-11-10 Not applicable No public exploit Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.
CVE-2026-125341 Low 2026-11-10 Not applicable No public exploit Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.
CVE-2026-125340 Medium 2026-11-10 Not applicable No public exploit Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14.
CVE-2026-125338 Medium 2026-11-10 Not applicable No public exploit Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14.
CVE-2026-125082 Low 2026-11-10 Not applicable Proof of concept only A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is named 714521a9262e7bc9ca5713c873f57e96a4845352. It is recommended to apply a patch to fix this issue.
CVE-2026-123341 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
CVE-2026-123259 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVE-2026-123258 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-122102 High 2026-11-10 Not applicable No public exploit Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVE-2026-121912 Medium 2026-11-10 Not applicable No public exploit Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVE-2026-121910 Medium 2026-11-10 Not applicable No public exploit Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
CVE-2026-121904 Critical 2026-11-10 Not applicable No public exploit Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVE-2026-121664 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-120350 Medium 2026-11-10 No exploit published No public exploit The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into live DOM. A value crafted to break out of the href attribute therefore runs script in the viewer's browser. An attacker who can edit shared content pastes a video embed carrying the payload, the delta is stored, and the script runs when any user opens the page, including in read only mode. Only content persisted through asDelta() is affected. The default HTML value, set and read through setValue and getValue, is sanitized on the server with a safelist that has no iframe, so the embed does not survive that path. Vaadin 24 and older are not affected: they build the HTML value from the editor's own innerHTML, which the browser escapes. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.12 Vaadin 25.3.0 - 25.3.4 Mitigation No fixed release on this line, upgrade to 25.2.13 or newer No fixed release on this line, upgrade to 25.2.13 or newer Upgrade to 25.2.13 Upgrade to 25.3.5
CVE-2026-120212 Unknown 2026-11-10 Not applicable No public exploit Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
CVE-2026-120016 Medium 2026-11-10 Not applicable No public exploit SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.
CVE-2026-119975 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-118481 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-118480 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-118479 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-118478 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVE-2026-118197 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
CVE-2026-116926 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-115640 High 2026-11-10 Not applicable No public exploit LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions.
CVE-2026-114372 Medium 2026-11-10 Not applicable No public exploit Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVE-2026-111303 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-111300 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-111297 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-110065 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-110045 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-109810 Medium 2026-11-10 Not applicable No public exploit SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.
CVE-2026-109504 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-109497 High 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-109456 Medium 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-109454 Critical 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-108469 Medium 2026-11-10 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-105150 Medium 2026-11-10 Not applicable No public exploit The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2026-104676 Medium 2026-11-10 Not applicable No public exploit The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file.
CVE-2026-66675 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Stored XSS.This issue affects Motors: from n/a through 1.4.128.
CVE-2026-54863 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4.
CVE-2026-125112 Low 2026-11-09 Not applicable No public exploit djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.
CVE-2026-124916 Medium 2026-11-09 Not applicable No public exploit PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
CVE-2026-124637 Medium 2026-11-09 Not applicable No public exploit A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.
CVE-2026-124570 Low 2026-11-09 Not applicable Proof of concept only A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argument employee avatar filename results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2026-124506 Low 2026-11-09 Not applicable No public exploit A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-INF/tags/hourlyReport.tag of the component Report Handler. The manipulation of the argument domain leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-123766 Medium 2026-11-09 No exploit published No public exploit Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
CVE-2026-123484 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123482 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
CVE-2026-123476 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Stored XSS.This issue affects Featured Image from URL: from n/a through 6.1.4.
CVE-2026-123463 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.4.0.
CVE-2026-123460 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.
CVE-2026-123364 Low 2026-11-09 Not applicable No public exploit OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.
CVE-2026-122673 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.
CVE-2026-122666 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.This issue affects Mang Board WP: from n/a through 2.4.7.
CVE-2026-122665 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Stored XSS.This issue affects Mang Board WP: from n/a through 2.4.7.
CVE-2026-122664 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Reflected XSS.This issue affects Broadcast Live Video: from n/a through 7.3.14.
CVE-2026-122661 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7.
CVE-2026-121782 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.3.
CVE-2026-121780 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.
CVE-2026-121764 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
CVE-2026-121763 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.
CVE-2026-121573 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.
CVE-2026-121570 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.
CVE-2026-120856 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.
CVE-2026-120855 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.
CVE-2026-120838 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 5.0.0.
CVE-2026-119524 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.
CVE-2026-119505 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.6.
CVE-2026-119504 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Stored XSS.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
CVE-2026-119497 Medium 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.6.
CVE-2026-119483 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50.
CVE-2026-118492 Low 2026-11-09 Not applicable Proof of concept only In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rendering them in the default hover popup provided by `addHoverPopupHandler`. If a Langium grammar allows cross-reference text to contain HTML markup (such as through a STRING terminal), an unresolved cross-reference produces a diagnostic message that includes the literal ref text. When a Sprotty diagram is opened for a malicious source file under these conditions, and a user hovers over the corresponding error marker, attacker-controlled JavaScript can execute in the browser or webview.
CVE-2026-112204 Medium 2026-11-09 Not applicable No public exploit WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5.
CVE-2026-111403 High 2026-11-09 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9.
CVE-2025-10248 High 2026-11-09 Not applicable No public exploit XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack.
‹ prev page 3 of 497 next ›