Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,759 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-9195 |
critical | 9.3 | 0.0065 | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 | |
CVE-2026-57858 |
critical | 9.3 | 0.0037 | 2026-08-12 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in | |
CVE-2026-75626 |
critical | 9.3 | 0.0033 | 2026-08-18 | SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s | |
CVE-2026-74902 |
critical | 9.3 | 0.0020 | 2026-08-18 | SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flo | |
CVE-2026-75828 |
critical | 9.3 | 0.0039 | 2026-08-18 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function | |
CVE-2026-106629 |
critical | 9.3 | 0.0087 | 2026-10-13 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could | |
CVE-2026-106630 |
critical | 9.3 | 0.0087 | 2026-10-13 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could | |
CVE-2026-76475 |
critical | 9.3 | 0.0033 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams f | |
CVE-2026-55486 |
critical | 9.3 | 0.0026 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-73329 |
critical | 9.2 | 0.0042 | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privi | |
CVE-2026-41201 |
critical | 9.1 | 0.0033 | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34559 |
critical | 9.0 | 0.0032 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34560 |
critical | 9.0 | 0.0038 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34562 |
critical | 9.0 | 0.0027 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34563 |
critical | 9.0 | 0.0027 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34564 |
critical | 9.0 | 0.0031 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34565 |
critical | 9.0 | 0.0027 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34566 |
critical | 9.0 | 0.0027 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34567 |
critical | 9.0 | 0.0027 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34568 |
critical | 9.0 | 0.0032 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34569 |
critical | 9.0 | 0.0032 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34571 |
critical | 9.0 | 0.0039 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-35035 |
critical | 9.0 | 0.0046 | 2026-04-06 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-40487 |
critical | 9.0 | 0.0022 | 2026-04-18 | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypa | |
CVE-2026-42523 |
critical | 9.0 | 0.0028 | 2026-04-29 | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScr | |
CVE-2026-55570 |
critical | 9.0 | 0.0040 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape th | |
CVE-2026-62378 |
critical | 9.0 | 0.0042 | 2026-07-15 | RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until | |
CVE-2026-39328 |
high | 8.9 | 0.0020 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting | |
CVE-2026-40873 |
high | 8.9 | 0.0042 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-42611 |
high | 8.9 | 0.0030 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to crea | |
CVE-2024-39024 |
high | 8.8 | 0.0079 | 2026-08-06 | In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. | |
CVE-2026-56840 |
high | 8.8 | 0.0025 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots | |
CVE-2026-116836 |
high | 8.8 | 0.0019 | 2026-10-27 | A malicious actor with access to the adjacent network and under certain conditions could exploit a S | |
CVE-2026-65767 |
high | 8.8 | 0.0061 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Te | |
CVE-2026-57104 |
high | 8.8 | 0.0086 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storag | |
CVE-2026-96230 |
high | 8.8 | 0.0095 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core | |
CVE-2026-3953 |
high | 8.8 | 0.0034 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-43892 |
high | 8.8 | 0.0026 | 2026-05-12 | AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitiz | |
CVE-2026-23819 |
high | 8.8 | 0.0027 | 2026-05-12 | A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Inst | |
CVE-2026-7498 |
high | 8.8 | 0.0030 | 2026-05-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-7569 |
high | 8.8 | 0.0094 | 2026-06-25 | Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vuln | |
CVE-2026-9780 |
high | 8.8 | 0.0094 | 2026-06-25 | Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vuln | |
CVE-2026-48307 |
high | 8.8 | 0.0055 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XS | |
CVE-2026-60633 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60634 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60635 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60636 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60637 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60638 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60639 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten |