Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,759 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-60664 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-14334 |
high | 8.8 | 0.0054 | 2026-08-19 | The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly s | |
CVE-2026-16617 |
high | 8.8 | 0.0050 | 2026-08-19 | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's | |
CVE-2026-86794 |
high | 8.8 | — | 2026-10-29 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when | |
CVE-2026-10632 |
high | 8.7 | 0.0030 | 2026-10-23 | A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Sui | |
CVE-2026-102800 |
high | 8.7 | 0.0039 | 2026-10-27 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - Th | |
CVE-2026-34748 |
high | 8.7 | 0.0029 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.78.0 in @pa | |
CVE-2026-35574 |
high | 8.7 | 0.0031 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting | |
CVE-2026-35576 |
high | 8.7 | 0.0026 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting | |
CVE-2026-39332 |
high | 8.7 | 0.0020 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripti | |
CVE-2026-39333 |
high | 8.7 | 0.0022 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint | |
CVE-2026-35569 |
high | 8.7 | 0.0030 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-40262 |
high | 8.7 | 0.0031 | 2026-04-17 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset deliver | |
CVE-2026-41524 |
high | 8.7 | 0.0026 | 2026-05-08 | Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body content entered thro | |
CVE-2026-34686 |
high | 8.7 | 0.0040 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-42197 |
high | 8.7 | 0.0031 | 2026-05-27 | RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566 | |
CVE-2026-53608 |
high | 8.7 | 0.0026 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4. | |
CVE-2026-54759 |
high | 8.7 | 0.0033 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer | |
CVE-2026-13323 |
high | 8.7 | 0.0033 | 2026-07-01 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with | |
CVE-2026-28737 |
high | 8.7 | 0.0041 | 2026-07-03 | Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsReq | |
CVE-2026-55596 |
high | 8.7 | 0.0031 | 2026-07-08 | Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed rendere | |
CVE-2026-61875 |
high | 8.7 | 0.0036 | 2026-07-12 | luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN c | |
CVE-2026-57829 |
high | 8.7 | 0.0025 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Jooml | |
CVE-2026-58077 |
high | 8.7 | 0.0044 | 2026-07-15 | Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extens | |
CVE-2026-45738 |
high | 8.7 | 0.0061 | 2026-07-15 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, a | |
CVE-2026-58148 |
high | 8.7 | 0.0044 | 2026-07-17 | Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 - | |
CVE-2026-54498 |
high | 8.7 | 0.0045 | 2026-07-17 | view_component is a framework for building reusable, testable, and encapsulated view components in R | |
CVE-2026-45270 |
high | 8.7 | 0.0026 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `P | |
CVE-2026-47743 |
high | 8.7 | 0.0038 | 2026-07-23 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir | |
CVE-2026-15810 |
high | 8.7 | 0.0045 | 2026-07-24 | A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12. | |
CVE-2026-55730 |
high | 8.7 | 0.0061 | 2026-07-24 | Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms | |
CVE-2026-66494 |
high | 8.7 | 0.0050 | 2026-08-07 | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builde | |
CVE-2026-55839 |
high | 8.7 | 0.0043 | 2026-08-18 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Mark | |
CVE-2024-58305 |
high | 8.6 | 0.0043 | 2025-12-12 | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malici | |
CVE-2026-102790 |
high | 8.6 | — | 2026-10-28 | Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4 | |
CVE-2026-67073 |
high | 8.6 | — | 2026-10-28 | HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. | |
CVE-2026-118245 |
high | 8.6 | — | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dash | |
CVE-2026-118254 |
high | 8.6 | — | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid | |
CVE-2026-33955 |
high | 8.6 | 0.0035 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulne | |
CVE-2026-39338 |
high | 8.6 | 0.0022 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site S | |
CVE-2026-41683 |
high | 8.6 | 0.0033 | 2026-05-08 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti | |
CVE-2026-42557 |
high | 8.6 | 0.0037 | 2026-05-13 | jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup | |
CVE-2026-42548 |
high | 8.6 | 0.0045 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ? | |
CVE-2026-59833 |
high | 8.6 | 0.0049 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note a | |
CVE-2026-57833 |
high | 8.6 | 0.0044 | 2026-07-15 | Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extens | |
CVE-2026-9585 |
high | 8.6 | 0.0055 | 2026-07-17 | An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SM | |
CVE-2026-60028 |
high | 8.6 | 0.0042 | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joom | |
CVE-2026-59239 |
high | 8.6 | 0.0067 | 2026-07-27 | Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 al | |
CVE-2026-18084 |
high | 8.6 | 0.0025 | 2026-07-28 | Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Manageme | |
CVE-2026-67328 |
high | 8.6 | 0.0049 | 2026-08-01 | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SS |