Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,856 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-51734 |
medium | 5.4 | 0.0019 | 2025-11-28 | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
CVE-2025-63528 |
medium | 5.4 | 0.0033 | 2025-12-01 | A cross-site scripting (XSS) vulnerability exists in the Blood Bank Management System 1.0 within the | |
CVE-2026-4364 |
medium | 5.4 | 0.0009 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 | |
CVE-2026-1243 |
medium | 5.4 | 0.0021 | 2026-04-02 | IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerabi | |
CVE-2026-32629 |
medium | 5.4 | 0.0026 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker | |
CVE-2026-35046 |
medium | 5.4 | 0.0017 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-40212 |
medium | 5.4 | 0.0022 | 2026-04-10 | OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerab | |
CVE-2026-35600 |
medium | 5.4 | 0.0019 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embe | |
CVE-2026-32893 |
medium | 5.4 | 0.0014 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting ( | |
CVE-2026-35565 |
medium | 5.4 | 0.0047 | 2026-04-13 | Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Af | |
CVE-2026-4914 |
medium | 5.4 | 0.0034 | 2026-04-14 | Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain l | |
CVE-2026-22154 |
medium | 5.4 | 0.0022 | 2026-04-14 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerabilit | |
CVE-2026-20945 |
medium | 5.4 | 0.1908 | 2026-04-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-27258 |
medium | 5.4 | 0.0018 | 2026-04-14 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could | |
CVE-2026-27288 |
medium | 5.4 | 0.0019 | 2026-04-14 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site | |
CVE-2026-33889 |
medium | 5.4 | 0.0022 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-40483 |
medium | 5.4 | 0.0022 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor | |
CVE-2026-41061 |
medium | 5.4 | 0.0017 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` re | |
CVE-2026-41063 |
medium | 5.4 | 0.0022 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in A | |
CVE-2026-3007 |
medium | 5.4 | 0.0017 | 2026-04-23 | Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attack | |
CVE-2026-31953 |
medium | 5.4 | 0.0014 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-41318 |
medium | 5.4 | 0.0019 | 2026-04-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as refe | |
CVE-2026-7026 |
medium | 5.4 | 0.0056 | 2026-04-26 | A vulnerability was determined in D-Link DGS-3420 1.50.018. This issue affects some unknown processi | |
CVE-2026-40201 |
medium | 5.4 | 0.0024 | 2026-05-01 | @diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md f | |
CVE-2026-5077 |
medium | 5.4 | 0.0019 | 2026-05-02 | The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versio | |
CVE-2026-7939 |
medium | 5.4 | 0.0016 | 2026-05-06 | Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remot | |
CVE-2026-7958 |
medium | 5.4 | 0.0014 | 2026-05-06 | Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an att | |
CVE-2026-8012 |
medium | 5.4 | 0.0014 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attac | |
CVE-2026-40296 |
medium | 5.4 | 0.0022 | 2026-05-06 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skip | |
CVE-2026-42192 |
medium | 5.4 | 0.0018 | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cro | |
CVE-2026-42612 |
medium | 5.4 | 0.0024 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulner | |
CVE-2026-42842 |
medium | 5.4 | 0.0018 | 2026-05-11 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Si | |
CVE-2026-42857 |
medium | 5.4 | 0.0018 | 2026-05-11 | Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanit | |
CVE-2026-42877 |
medium | 5.4 | 0.0019 | 2026-05-27 | FacturaScripts is an open source accounting and invoicing software. In 2025.92 and earlier, a stored | |
CVE-2026-53441 |
medium | 5.4 | 0.0026 | 2026-06-10 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not | |
CVE-2026-53606 |
medium | 5.4 | 0.0021 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simp | |
CVE-2026-32208 |
medium | 5.4 | 0.0052 | 2026-06-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft En | |
CVE-2026-9029 |
medium | 5.4 | 0.0025 | 2026-06-22 | A user with Editor permissions can place a malicious script in the attribution field of a Geomap pan | |
CVE-2026-11372 |
medium | 5.4 | 0.0023 | 2026-06-22 | IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vul | |
CVE-2026-4983 |
medium | 5.4 | 0.0031 | 2026-06-23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serv | |
CVE-2026-10086 |
medium | 5.4 | 0.0035 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 be | |
CVE-2026-54025 |
medium | 5.4 | 0.0024 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, ther | |
CVE-2026-50740 |
medium | 5.4 | 0.0038 | 2026-06-26 | A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive A | |
CVE-2026-50742 |
medium | 5.4 | 0.0034 | 2026-06-26 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-chec | |
CVE-2026-6658 |
medium | 5.4 | 0.0016 | 2026-06-26 | A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via un | |
CVE-2026-13977 |
medium | 5.4 | 0.0022 | 2026-06-30 | Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote | |
CVE-2026-6283 |
medium | 5.4 | 0.0023 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-54720 |
medium | 5.4 | 0.0026 | 2026-07-01 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6. | |
CVE-2026-4772 |
medium | 5.4 | 0.0023 | 2026-07-02 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-8309 |
medium | 5.4 | 0.0023 | 2026-07-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i |