Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,848 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-72832 |
medium | 5.1 | 0.0031 | 2026-08-14 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the S | |
CVE-2026-90931 |
medium | 5.1 | 0.0024 | 2026-09-14 | 1 PoC | LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, al |
CVE-2026-41610 |
medium | 5.0 | 0.0060 | 2026-05-12 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studi | |
CVE-2026-43979 |
medium | 5.0 | 0.0033 | 2026-05-28 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0 | |
CVE-2026-57439 |
medium | 5.0 | 0.0014 | 2026-07-08 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, th | |
CVE-2026-42447 |
medium | 5.0 | 0.0022 | 2026-07-14 | jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerab | |
CVE-2026-70588 |
medium | 5.0 | 0.0043 | 2026-08-04 | Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature | |
CVE-2026-118169 |
medium | 4.9 | 0.0019 | 2026-10-28 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to | |
CVE-2026-114570 |
medium | 4.9 | 0.0022 | 2026-10-22 | WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, an | |
CVE-2026-109216 |
medium | 4.9 | — | 2026-10-29 | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-S | |
CVE-2026-115535 |
medium | 4.8 | 0.0021 | 2026-10-23 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d4 | |
CVE-2026-4950 |
medium | 4.8 | 0.0031 | 2026-10-23 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users | |
CVE-2026-116882 |
medium | 4.8 | 0.0015 | 2026-10-27 | Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that | |
CVE-2026-116883 |
medium | 4.8 | 0.0015 | 2026-10-27 | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that | |
CVE-2026-116888 |
medium | 4.8 | 0.0015 | 2026-10-27 | SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that | |
CVE-2013-20009 |
medium | 4.8 | 0.0022 | 2026-10-28 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows aut | |
CVE-2026-113409 |
medium | 4.8 | 0.0020 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings pa | |
CVE-2026-66092 |
medium | 4.8 | 0.0033 | 2026-10-29 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logo | |
CVE-2026-39991 |
medium | 4.8 | 0.0029 | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote | |
CVE-2026-50684 |
medium | 4.8 | 0.0040 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Active Direc | |
CVE-2023-22685 |
medium | 4.8 | 0.0037 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tips and Tricks HQ, Ruhul Amin Cat | |
CVE-2026-20087 |
medium | 4.8 | 0.0018 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-20088 |
medium | 4.8 | 0.0023 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-20089 |
medium | 4.8 | 0.0025 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-20090 |
medium | 4.8 | 0.0025 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-34729 |
medium | 4.8 | 0.0024 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulner | |
CVE-2026-25932 |
medium | 4.8 | 0.0028 | 2026-04-06 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticat | |
CVE-2026-33405 |
medium | 4.8 | 0.0017 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra | |
CVE-2026-35571 |
medium | 4.8 | 0.0018 | 2026-04-07 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates | |
CVE-2026-37980 |
medium | 4.8 | 0.0036 | 2026-04-14 | A flaw was found in Keycloak, specifically in the organization selection login page. A remote attack | |
CVE-2026-39812 |
medium | 4.8 | 0.0019 | 2026-04-14 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability | |
CVE-2026-20132 |
medium | 4.8 | 0.0017 | 2026-04-15 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (IS | |
CVE-2026-1711 |
medium | 4.8 | 0.0019 | 2026-04-15 | Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerabil | |
CVE-2026-28263 |
medium | 4.8 | 0.0020 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions | |
CVE-2026-40593 |
medium | 4.8 | 0.0020 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (U | |
CVE-2026-6623 |
medium | 4.8 | 0.0021 | 2026-04-20 | A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20. This impacts an u | |
CVE-2026-23752 |
medium | 4.8 | 0.0015 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template grou | |
CVE-2026-23753 |
medium | 4.8 | 0.0015 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language mana | |
CVE-2026-4918 |
medium | 4.8 | 0.0014 | 2026-04-23 | IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This vulnerability a | |
CVE-2026-4919 |
medium | 4.8 | 0.0019 | 2026-04-23 | IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vulnerability allows a | |
CVE-2026-40230 |
medium | 4.8 | 0.0018 | 2026-04-29 | Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic | |
CVE-2026-42150 |
medium | 4.8 | 0.0017 | 2026-05-08 | wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML outp | |
CVE-2026-7814 |
medium | 4.8 | 0.0016 | 2026-05-11 | Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer mod | |
CVE-2026-34655 |
medium | 4.8 | 0.0037 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-34658 |
medium | 4.8 | 0.0027 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-42948 |
medium | 4.8 | 0.0016 | 2026-05-13 | Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one | |
CVE-2026-8078 |
medium | 4.8 | 0.0014 | 2026-06-08 | Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0 | |
CVE-2026-9549 |
medium | 4.8 | 0.0014 | 2026-06-08 | Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0 | |
CVE-2026-27870 |
medium | 4.8 | 0.0029 | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case | |
CVE-2026-22674 |
medium | 4.8 | 0.0031 | 2026-06-18 | Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vu |