Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,821 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-12047 |
medium | 4.8 | 0.0022 | 2026-06-19 | HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and | |
CVE-2026-12163 |
medium | 4.8 | 0.0024 | 2026-06-23 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 cont | |
CVE-2026-50703 |
medium | 4.8 | 0.0040 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-50708 |
medium | 4.8 | 0.0030 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-50709 |
medium | 4.8 | 0.0030 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-50712 |
medium | 4.8 | 0.0030 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-8661 |
medium | 4.8 | 0.0038 | 2026-06-26 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin o | |
CVE-2026-53907 |
medium | 4.8 | 0.0024 | 2026-07-01 | MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality | |
CVE-2026-34096 |
medium | 4.8 | 0.0024 | 2026-07-01 | Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML | |
CVE-2026-34097 |
medium | 4.8 | 0.0024 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HT | |
CVE-2026-34098 |
medium | 4.8 | 0.0024 | 2026-07-01 | Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source | |
CVE-2026-13373 |
medium | 4.8 | 0.0027 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-13374 |
medium | 4.8 | 0.0027 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-13375 |
medium | 4.8 | 0.0027 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-13376 |
medium | 4.8 | 0.0027 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-13377 |
medium | 4.8 | 0.0027 | 2026-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-6371 |
medium | 4.8 | 0.0023 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-56283 |
medium | 4.8 | 0.0017 | 2026-07-08 | Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint | |
CVE-2026-55890 |
medium | 4.8 | 0.0050 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through | |
CVE-2026-55464 |
medium | 4.8 | 0.0029 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but d | |
CVE-2026-1563 |
medium | 4.8 | 0.0024 | 2026-07-15 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) | |
CVE-2026-46516 |
medium | 4.8 | 0.0044 | 2026-07-20 | Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown f | |
CVE-2026-63281 |
medium | 4.8 | 0.0024 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored c | |
CVE-2026-34495 |
medium | 4.8 | 0.0023 | 2026-07-31 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-9318 |
medium | 4.8 | 0.0030 | 2026-08-12 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export funct | |
CVE-2026-70560 |
medium | 4.8 | 0.0020 | 2026-08-12 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability | |
CVE-2026-18372 |
medium | 4.8 | 0.0043 | 2026-08-19 | CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault adminis | |
CVE-2026-64971 |
medium | 4.8 | 0.0050 | 2026-08-20 | ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially | |
CVE-2026-64972 |
medium | 4.8 | 0.0040 | 2026-08-20 | ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker | |
CVE-2026-77506 |
medium | 4.8 | 0.0024 | 2026-08-20 | Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS. | |
CVE-2026-111932 |
medium | 4.8 | 0.0017 | 2026-10-17 | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains | |
CVE-2026-112249 |
medium | 4.8 | 0.0040 | 2026-10-19 | A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw | |
CVE-2026-113712 |
medium | 4.8 | 0.0046 | 2026-10-20 | Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scr | |
CVE-2026-115981 |
medium | 4.8 | 0.0025 | 2026-10-24 | A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is | |
CVE-2026-116148 |
medium | 4.8 | 0.0014 | 2026-10-25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG | |
CVE-2026-116227 |
medium | 4.8 | 0.0021 | 2026-10-26 | A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of | |
CVE-2026-5697 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to s | |
CVE-2026-5698 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to s | |
CVE-2026-5699 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to s | |
CVE-2026-5700 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to s | |
CVE-2026-113690 |
medium | 4.8 | — | 2026-10-29 | Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite ver | |
CVE-2026-113695 |
medium | 4.8 | — | 2026-10-29 | Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Mana | |
CVE-2026-113697 |
medium | 4.8 | — | 2026-10-29 | Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 | |
CVE-2026-56359 |
medium | 4.8 | 0.0024 | 2026-07-08 | n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow whe | |
CVE-2026-114718 |
medium | 4.7 | 0.0024 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnera | |
CVE-2026-61575 |
medium | 4.7 | 0.0018 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-c | |
CVE-2026-33916 |
medium | 4.7 | 0.0028 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 thr | |
CVE-2026-40301 |
medium | 4.7 | 0.0032 | 2026-04-17 | DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sani | |
CVE-2026-41692 |
medium | 4.7 | 0.0014 | 2026-05-07 | i18nextify is a JavaScript library that adds website internationalization via a script tag, without | |
CVE-2026-44581 |
medium | 4.7 | 0.0022 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 |