Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,878 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40137 |
medium | 6.1 | 0.0021 | 2026-05-12 | SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicio | |
CVE-2026-44580 |
medium | 6.1 | 0.0021 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 | |
CVE-2026-42897 |
medium | 6.1 | 0.7066 | 2026-05-14 | KEV | Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation i |
CVE-2026-44366 |
medium | 6.1 | 0.0028 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-46642 |
medium | 6.1 | 0.0022 | 2026-06-10 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a cra | |
CVE-2026-48157 |
medium | 6.1 | 0.0017 | 2026-06-15 | Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versi | |
CVE-2026-12459 |
medium | 6.1 | 0.0018 | 2026-06-17 | Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote att | |
CVE-2026-44587 |
medium | 6.1 | 0.0022 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3. | |
CVE-2026-44644 |
medium | 6.1 | 0.0025 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 1 | |
CVE-2026-54298 |
medium | 6.1 | 0.0023 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rende | |
CVE-2026-44311 |
medium | 6.1 | 0.0027 | 2026-06-22 | Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XS | |
CVE-2026-10857 |
medium | 6.1 | 0.0025 | 2026-06-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-34915 |
medium | 6.1 | 0.0026 | 2026-06-23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and ear | |
CVE-2026-48942 |
medium | 6.1 | 0.0025 | 2026-06-25 | K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinc | |
CVE-2026-50745 |
medium | 6.1 | 0.0038 | 2026-06-26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way U | |
CVE-2026-57326 |
medium | 6.1 | 0.0025 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. | |
CVE-2026-8403 |
medium | 6.1 | 0.0025 | 2026-06-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-11594 |
medium | 6.1 | 0.0034 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in | |
CVE-2026-13836 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14000 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14001 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote att | |
CVE-2026-14068 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a rem | |
CVE-2026-14145 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14147 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-4322 |
medium | 6.1 | 0.0025 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-8306 |
medium | 6.1 | 0.0025 | 2026-07-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-8310 |
medium | 6.1 | 0.0025 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-59895 |
medium | 6.1 | 0.0033 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 bef | |
CVE-2026-59923 |
medium | 6.1 | 0.0035 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_ur | |
CVE-2026-59929 |
medium | 6.1 | 0.0034 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter | |
CVE-2026-55877 |
medium | 6.1 | 0.0034 | 2026-07-08 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.17.0 before 2.36.1 and from 3.0.0 before 3. | |
CVE-2026-15127 |
medium | 6.1 | 0.0022 | 2026-07-08 | Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote atta | |
CVE-2026-15128 |
medium | 6.1 | 0.0022 | 2026-07-08 | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote atta | |
CVE-2026-47646 |
medium | 6.1 | 0.0047 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 | |
CVE-2026-5793 |
medium | 6.1 | 0.0025 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-59795 |
medium | 6.1 | 0.0034 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible | |
CVE-2026-61492 |
medium | 6.1 | 0.0066 | 2026-07-10 | In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possibl | |
CVE-2026-54714 |
medium | 6.1 | 0.0034 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/c | |
CVE-2026-10770 |
medium | 6.1 | 0.0026 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-13231 |
medium | 6.1 | 0.0025 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-13234 |
medium | 6.1 | 0.0025 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-58587 |
medium | 6.1 | 0.0026 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-58588 |
medium | 6.1 | 0.0026 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-44759 |
medium | 6.1 | 0.0029 | 2026-07-14 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into | |
CVE-2026-44767 |
medium | 6.1 | 0.0029 | 2026-07-14 | setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled abs | |
CVE-2026-23573 |
medium | 6.1 | 0.0039 | 2026-07-14 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilit | |
CVE-2026-49458 |
medium | 6.1 | 0.0040 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DO | |
CVE-2026-49459 |
medium | 6.1 | 0.0037 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DO | |
CVE-2026-41580 |
medium | 6.1 | 0.0027 | 2026-07-15 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P | |
CVE-2026-50182 |
medium | 6.1 | 0.0022 | 2026-07-15 | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Refl |