Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,799 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54433 |
critical | 10.0 | 0.0031 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS | |
CVE-2026-50551 |
critical | 9.9 | 0.0056 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a sto | |
CVE-2026-54067 |
critical | 9.9 | 0.0038 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body cont | |
CVE-2026-54158 |
critical | 9.9 | 0.0036 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (d | |
CVE-2026-11913 |
critical | 9.8 | 0.0056 | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. | |
CVE-2026-104252 |
critical | 9.8 | 0.0117 | 2026-10-13 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, | |
CVE-2025-65200 |
critical | 9.6 | 0.0055 | 2026-10-22 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted | |
CVE-2026-70332 |
critical | 9.6 | 0.0086 | 2026-08-06 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55008 |
critical | 9.6 | 0.0086 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex | |
CVE-2026-33976 |
critical | 9.6 | 0.0072 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a | |
CVE-2026-1115 |
critical | 9.6 | 0.0126 | 2026-04-10 | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/l | |
CVE-2026-42090 |
critical | 9.6 | 0.0048 | 2026-05-04 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop | |
CVE-2026-44482 |
critical | 9.6 | 0.0034 | 2026-05-14 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock sup | |
CVE-2026-45323 |
critical | 9.6 | 0.0032 | 2026-05-28 | MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node name | |
CVE-2026-46853 |
critical | 9.6 | 0.0048 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c | |
CVE-2026-46856 |
critical | 9.6 | 0.0047 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c | |
CVE-2026-53662 |
critical | 9.6 | 0.0030 | 2026-06-23 | immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 u | |
CVE-2026-57625 |
critical | 9.6 | 0.0045 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 version | |
CVE-2026-47428 |
critical | 9.6 | 0.0058 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Brow | |
CVE-2026-54458 |
critical | 9.6 | 0.0038 | 2026-07-15 | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site | |
CVE-2026-63190 |
critical | 9.4 | 0.0054 | 2026-10-28 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior | |
CVE-2026-34989 |
critical | 9.4 | 0.0030 | 2026-04-06 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-61876 |
critical | 9.4 | 0.0162 | 2026-07-12 | LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allo | |
CVE-2026-60034 |
critical | 9.4 | 0.0042 | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Jooml | |
CVE-2026-65605 |
critical | 9.4 | 0.0079 | 2026-07-23 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (databas | |
CVE-2026-66395 |
critical | 9.4 | 0.0056 | 2026-07-27 | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p | |
CVE-2026-104350 |
critical | 9.3 | 0.0060 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An | |
CVE-2026-70306 |
critical | 9.3 | 0.0101 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-70279 |
critical | 9.3 | 0.0129 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex | |
CVE-2026-31845 |
critical | 9.3 | 0.0043 | 2026-04-11 | A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and ear | |
CVE-2026-27243 |
critical | 9.3 | 0.0030 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (X | |
CVE-2026-27245 |
critical | 9.3 | 0.0030 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (X | |
CVE-2026-27246 |
critical | 9.3 | 0.0030 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (X | |
CVE-2026-40872 |
critical | 9.3 | 0.0036 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-43900 |
critical | 9.3 | 0.0037 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and ag | |
CVE-2026-48768 |
critical | 9.3 | 0.0033 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/ge | |
CVE-2026-12048 |
critical | 9.3 | 0.0027 | 2026-06-19 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text retur | |
CVE-2026-44727 |
critical | 9.3 | 0.0044 | 2026-06-22 | Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handle | |
CVE-2026-11708 |
critical | 9.3 | 0.0038 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in | |
CVE-2026-11712 |
critical | 9.3 | 0.0038 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in | |
CVE-2026-54527 |
critical | 9.3 | 0.0053 | 2026-07-08 | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts | |
CVE-2026-2342 |
critical | 9.3 | 0.0039 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-15091 |
critical | 9.3 | 0.0057 | 2026-07-17 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary sc | |
CVE-2026-39878 |
critical | 9.3 | 0.0043 | 2026-07-20 | Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the | |
CVE-2026-65048 |
critical | 9.3 | 0.0054 | 2026-07-21 | Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored c | |
CVE-2026-8152 |
critical | 9.3 | 0.0041 | 2026-07-22 | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site | |
CVE-2026-66394 |
critical | 9.3 | 0.0034 | 2026-07-27 | SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanit | |
CVE-2026-66396 |
critical | 9.3 | 0.0054 | 2026-07-27 | SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Ga | |
CVE-2026-11707 |
critical | 9.3 | 0.0038 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte | |
CVE-2026-66418 |
critical | 9.3 | 0.0063 | 2026-07-30 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthent |