Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,853 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116804 |
medium | 5.1 | 0.0018 | 2026-10-27 | DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve | |
CVE-2026-116891 |
medium | 5.1 | 0.0017 | 2026-10-27 | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability th | |
CVE-2026-116900 |
medium | 5.1 | 0.0014 | 2026-10-27 | REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editor | |
CVE-2026-117535 |
medium | 5.1 | 0.0020 | 2026-10-27 | REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media po | |
CVE-2026-117539 |
medium | 5.1 | 0.0018 | 2026-10-27 | darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabil | |
CVE-2026-105987 |
medium | 5.1 | 0.0024 | 2026-10-27 | KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input | |
CVE-2026-112356 |
medium | 5.1 | 0.0025 | 2026-10-28 | GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability | |
CVE-2026-116229 |
medium | 5.1 | 0.0020 | 2026-10-26 | A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the fun | |
CVE-2026-32859 |
medium | 5.1 | 0.0020 | 2026-03-27 | ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerabil | |
CVE-2026-5010 |
medium | 5.1 | 0.0028 | 2026-03-27 | A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerabi | |
CVE-2026-34951 |
medium | 5.1 | 0.0015 | 2026-04-06 | Workbench is a suite of tools for administrators and developers to interact with Salesforce.com orga | |
CVE-2026-21904 |
medium | 5.1 | 0.0021 | 2026-04-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilit | |
CVE-2026-6107 |
medium | 5.1 | 0.0021 | 2026-04-12 | A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of | |
CVE-2026-40038 |
medium | 5.1 | 0.0016 | 2026-04-13 | Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute a | |
CVE-2026-39426 |
medium | 5.1 | 0.0019 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross | |
CVE-2026-24906 |
medium | 5.1 | 0.0025 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 c | |
CVE-2026-24907 |
medium | 5.1 | 0.0020 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 c | |
CVE-2026-32963 |
medium | 5.1 | 0.0016 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting | |
CVE-2026-34429 |
medium | 5.1 | 0.0028 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticate | |
CVE-2026-23756 |
medium | 5.1 | 0.0014 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshoote | |
CVE-2026-23757 |
medium | 5.1 | 0.0014 | 2026-04-20 | GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports modu | |
CVE-2026-3317 |
medium | 5.1 | 0.0034 | 2026-04-21 | Reflected Cross-Site Scripting (XSS) vulnerability in Navigate Content Management System. The vulner | |
CVE-2026-40451 |
medium | 5.1 | 0.0017 | 2026-04-22 | DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vuln | |
CVE-2026-40229 |
medium | 5.1 | 0.0018 | 2026-04-29 | Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any reg | |
CVE-2026-41929 |
medium | 5.1 | 0.0024 | 2026-05-07 | Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the | |
CVE-2026-3319 |
medium | 5.1 | 0.0032 | 2026-05-11 | Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. Us | |
CVE-2026-3320 |
medium | 5.1 | 0.0032 | 2026-05-11 | Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. Us | |
CVE-2026-7308 |
medium | 5.1 | 0.0026 | 2026-05-11 | An authenticated user with upload permission to a hosted repository can store content that causes ar | |
CVE-2026-42157 |
medium | 5.1 | 0.0034 | 2026-05-12 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, tr | |
CVE-2026-45228 |
medium | 5.1 | 0.0018 | 2026-05-13 | Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configur | |
CVE-2026-43644 |
medium | 5.1 | 0.0019 | 2026-05-14 | podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api | |
CVE-2026-1630 |
medium | 5.1 | 0.0043 | 2026-05-14 | WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. | |
CVE-2026-44429 |
medium | 5.1 | 0.0017 | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. | |
CVE-2026-45616 |
medium | 5.1 | 0.0029 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-46360 |
medium | 5.1 | 0.0019 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAl | |
CVE-2026-46363 |
medium | 5.1 | 0.0019 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and updat | |
CVE-2026-48225 |
medium | 5.1 | 0.0021 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php | |
CVE-2026-48230 |
medium | 5.1 | 0.0021 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmd | |
CVE-2026-50230 |
medium | 5.1 | 0.0041 | 2026-06-05 | Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability i | |
CVE-2026-50231 |
medium | 5.1 | 0.0018 | 2026-06-05 | Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in t | |
CVE-2026-50232 |
medium | 5.1 | 0.0024 | 2026-06-05 | Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers | |
CVE-2026-50235 |
medium | 5.1 | 0.0016 | 2026-06-05 | Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search | |
CVE-2026-7190 |
medium | 5.1 | 0.0034 | 2026-10-29 | A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo envi | |
CVE-2026-54386 |
medium | 5.1 | 0.0024 | 2026-06-17 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page th | |
CVE-2026-54219 |
medium | 5.1 | 0.0029 | 2026-06-18 | UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fail | |
CVE-2026-54221 |
medium | 5.1 | 0.0029 | 2026-06-18 | UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain | |
CVE-2026-11982 |
medium | 5.1 | 0.0038 | 2026-06-18 | Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability i | |
CVE-2026-12619 |
medium | 5.1 | 0.0023 | 2026-06-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-12580 |
medium | 5.1 | 0.0028 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authent | |
CVE-2026-11772 |
medium | 5.1 | 0.0055 | 2026-06-23 | DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can |