Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,873 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-51025 |
medium | 6.1 | 0.0025 | 2026-07-20 | Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker | |
CVE-2026-65756 |
medium | 6.1 | 0.0025 | 2026-07-23 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configura | |
CVE-2026-64810 |
medium | 6.1 | 0.0025 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowin | |
CVE-2026-8308 |
medium | 6.1 | 0.0025 | 2026-07-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-66390 |
medium | 6.1 | 0.0057 | 2026-07-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-53667 |
medium | 6.1 | 0.0036 | 2026-07-27 | React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missin | |
CVE-2026-8167 |
medium | 6.1 | 0.0025 | 2026-07-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-65882 |
medium | 6.1 | 0.0025 | 2026-07-28 | Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url param | |
CVE-2026-14515 |
medium | 6.1 | 0.0030 | 2026-07-28 | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a | |
CVE-2026-65946 |
medium | 6.1 | 0.0025 | 2026-07-29 | Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0 | |
CVE-2026-66490 |
medium | 6.1 | 0.0027 | 2026-07-29 | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20. | |
CVE-2026-17797 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17818 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote att | |
CVE-2026-17827 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17845 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17853 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-17878 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17962 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attac | |
CVE-2026-61526 |
medium | 6.1 | 0.0034 | 2026-07-30 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions | |
CVE-2026-10032 |
medium | 6.1 | 0.0013 | 2026-08-04 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() with | |
CVE-2026-71435 |
medium | 6.1 | 0.0034 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, t | |
CVE-2026-71478 |
medium | 6.1 | 0.0036 | 2026-08-06 | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2 | |
CVE-2026-66771 |
medium | 6.1 | 0.0038 | 2026-08-11 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into | |
CVE-2026-66146 |
medium | 6.1 | 0.0030 | 2026-08-11 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) a | |
CVE-2026-19657 |
medium | 6.1 | 0.0028 | 2026-08-12 | ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthe | |
CVE-2026-50771 |
medium | 6.1 | 0.0031 | 2026-08-17 | Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to | |
CVE-2026-63670 |
medium | 6.1 | 0.0033 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() c | |
CVE-2025-63607 |
medium | 6.1 | 0.0026 | 2026-08-31 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoe | |
CVE-2026-77490 |
medium | 6.1 | 0.0041 | 2026-09-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ed | |
CVE-2026-91152 |
medium | 6.1 | 0.0035 | 2026-10-29 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin fo | |
CVE-2025-70515 |
medium | 6.1 | 0.0029 | 2026-10-07 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or enc | |
CVE-2025-70519 |
medium | 6.1 | 0.0023 | 2026-10-07 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or enc | |
CVE-2025-27895 |
medium | 6.1 | 0.0016 | 2026-10-12 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. | |
CVE-2025-27896 |
medium | 6.1 | 0.0016 | 2026-10-12 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. | |
CVE-2025-27897 |
medium | 6.1 | 0.0016 | 2026-10-12 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. | |
CVE-2026-94402 |
medium | 6.1 | 0.0025 | 2026-10-20 | IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart compon | |
CVE-2026-113787 |
medium | 6.1 | 0.0022 | 2026-10-21 | odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in | |
CVE-2026-33520 |
medium | 6.1 | 0.0025 | 2026-10-26 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and | |
CVE-2026-50095 |
medium | 6.1 | 0.0025 | 2026-10-26 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and L | |
CVE-2026-50096 |
medium | 6.1 | 0.0025 | 2026-10-26 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and | |
CVE-2025-30006 |
medium | 6.1 | 0.0025 | 2025-03-31 | Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative con | |
CVE-2023-6717 |
medium | 6.0 | 0.0071 | 2024-04-25 | A flaw was found in the SAML client registration in Keycloak that could allow an administrator to re | |
CVE-2026-41240 |
medium | 6.0 | 0.0031 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to | |
CVE-2026-42052 |
medium | 6.0 | 0.0030 | 2026-05-04 | Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Under | |
CVE-2026-57279 |
medium | 6.0 | 0.0032 | 2026-08-10 | Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an | |
CVE-2026-54615 |
medium | 6.0 | 0.0037 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2024-3773 |
medium | 5.9 | 0.0024 | 2026-09-02 | The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its sh | |
CVE-2025-59593 |
medium | 5.9 | 0.0022 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-21631 |
medium | 5.9 | 0.0022 | 2026-04-01 | Lack of output escaping leads to a XSS vector in the multilingual associations component. | |
CVE-2026-21632 |
medium | 5.9 | 0.0019 | 2026-04-01 | Lack of output escaping for article titles leads to XSS vectors in various locations. |