Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,854 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-36163 |
medium | 5.4 | 0.0017 | 2026-07-07 | An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated | |
CVE-2026-8315 |
medium | 5.4 | 0.0023 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-11903 |
medium | 5.4 | 0.0041 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-6896 |
medium | 5.4 | 0.0040 | 2026-07-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 b | |
CVE-2026-5005 |
medium | 5.4 | 0.0023 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-59794 |
medium | 5.4 | 0.0032 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-re | |
CVE-2026-8595 |
medium | 5.4 | 0.0024 | 2026-07-10 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a maliciou | |
CVE-2026-10769 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-11908 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-15082 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-15084 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-15085 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-55808 |
medium | 5.4 | 0.0027 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-58591 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-12228 |
medium | 5.4 | 0.0033 | 2026-07-18 | A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint o | |
CVE-2026-45138 |
medium | 5.4 | 0.0018 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the cu | |
CVE-2026-6793 |
medium | 5.4 | 0.0023 | 2026-07-20 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-44228 |
medium | 5.4 | 0.0026 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, p | |
CVE-2026-44229 |
medium | 5.4 | 0.0014 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 an | |
CVE-2026-64795 |
medium | 5.4 | 0.0023 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs exte | |
CVE-2026-15968 |
medium | 5.4 | 0.0033 | 2026-07-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-17728 |
medium | 5.4 | 0.0022 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote | |
CVE-2026-17734 |
medium | 5.4 | 0.0022 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-17903 |
medium | 5.4 | 0.0016 | 2026-07-30 | Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an att | |
CVE-2026-59328 |
medium | 5.4 | 0.0017 | 2026-07-30 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded | |
CVE-2026-11383 |
medium | 5.4 | 0.0023 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte | |
CVE-2026-62324 |
medium | 5.4 | 0.0031 | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodi | |
CVE-2026-14192 |
medium | 5.4 | 0.0023 | 2026-08-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-71275 |
medium | 5.4 | 0.0023 | 2026-08-05 | OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter dir | |
CVE-2026-70440 |
medium | 5.4 | 0.0023 | 2026-08-05 | Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controll | |
CVE-2026-70441 |
medium | 5.4 | 0.0023 | 2026-08-05 | Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context | |
CVE-2026-8166 |
medium | 5.4 | 0.0023 | 2026-08-06 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-54717 |
medium | 5.4 | 0.0034 | 2026-08-06 | Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in th | |
CVE-2026-72570 |
medium | 5.4 | 0.0024 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows | |
CVE-2026-72576 |
medium | 5.4 | 0.0029 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authe | |
CVE-2026-72583 |
medium | 5.4 | 0.0026 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privile | |
CVE-2026-56619 |
medium | 5.4 | 0.0023 | 2026-08-10 | HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficien | |
CVE-2026-72553 |
medium | 5.4 | 0.0023 | 2026-08-11 | A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member | |
CVE-2026-72559 |
medium | 5.4 | 0.0023 | 2026-08-11 | A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members | |
CVE-2026-73262 |
medium | 5.4 | 0.0030 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/li | |
CVE-2026-16694 |
medium | 5.4 | 0.0023 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows | |
CVE-2026-73295 |
medium | 5.4 | 0.0033 | 2026-08-12 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9 | |
CVE-2026-18099 |
medium | 5.4 | 0.0033 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script | |
CVE-2026-19447 |
medium | 5.4 | 0.0023 | 2026-08-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-55491 |
medium | 5.4 | 0.0029 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape m | |
CVE-2026-103485 |
medium | 5.4 | 0.0034 | 2026-10-29 | The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scr | |
CVE-2026-107627 |
medium | 5.4 | 0.0033 | 2026-10-29 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM- | |
CVE-2026-107629 |
medium | 5.4 | 0.0034 | 2026-10-29 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM- | |
CVE-2026-111318 |
medium | 5.4 | 0.0034 | 2026-10-29 | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vuln | |
CVE-2026-116763 |
medium | 5.4 | 0.0034 | 2026-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comme |