Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,799 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44752 |
high | 8.2 | 0.0036 | 2026-07-14 | SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScr | |
CVE-2026-47423 |
high | 8.2 | 0.0041 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurif | |
CVE-2026-65597 |
high | 8.2 | 0.0030 | 2026-07-22 | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting | |
CVE-2026-56670 |
high | 8.2 | 0.0040 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2 | |
CVE-2026-56672 |
high | 8.2 | 0.0040 | 2026-07-31 | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} | |
CVE-2026-71445 |
high | 8.2 | 0.0040 | 2026-08-06 | AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint | |
CVE-2026-73031 |
high | 8.2 | 0.0066 | 2026-08-11 | telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to | |
CVE-2026-75048 |
high | 8.2 | 0.0032 | 2026-08-17 | In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was po | |
CVE-2026-49825 |
high | 8.2 | 0.0030 | 2026-08-20 | lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attribute | |
CVE-2026-115193 |
high | 8.2 | 0.0031 | 2026-10-26 | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Val | |
CVE-2026-86016 |
high | 8.2 | 0.0022 | 2026-10-13 | VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_me | |
CVE-2026-116688 |
high | 8.1 | 0.0050 | 2026-10-27 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7. | |
CVE-2026-58205 |
high | 8.1 | 0.0029 | 2026-10-27 | GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects | |
CVE-2026-97783 |
high | 8.1 | 0.0050 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-50758 |
high | 8.1 | 0.0072 | 2026-07-21 | Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to | |
CVE-2026-17496 |
high | 8.1 | 0.0055 | 2026-07-26 | NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injec | |
CVE-2026-48060 |
high | 8.1 | 0.0035 | 2026-07-28 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Lite | |
CVE-2026-71285 |
high | 8.1 | 0.0038 | 2026-08-05 | Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin- | |
CVE-2026-48081 |
high | 8.1 | 0.0024 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-33437 |
high | 8.1 | 0.0040 | 2026-08-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P | |
CVE-2026-18147 |
high | 8.1 | 0.0053 | 2026-09-09 | A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scrip | |
CVE-2026-57105 |
high | 8.0 | 0.0062 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-58647 |
high | 8.0 | 0.0052 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Power BI all | |
CVE-2026-35575 |
high | 8.0 | 0.0024 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting | |
CVE-2026-42524 |
high | 8.0 | 0.0028 | 2026-04-29 | Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper | |
CVE-2026-60646 |
high | 8.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-60650 |
high | 8.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-65937 |
high | 8.0 | 0.0041 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend con | |
CVE-2026-55659 |
high | 7.7 | 0.0036 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server- | |
CVE-2026-49279 |
high | 7.7 | 0.0040 | 2026-07-15 | WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerabi | |
CVE-2026-35534 |
high | 7.6 | 0.0017 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting | |
CVE-2026-40283 |
high | 7.6 | 0.0020 | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site | |
CVE-2026-42224 |
high | 7.6 | 0.0026 | 2026-05-08 | ipl/web is a set of common web components for php projects. Prior to versions 0.13.1 and 0.10.3, the | |
CVE-2026-55409 |
high | 7.6 | 0.0028 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 un | |
CVE-2026-16969 |
high | 7.6 | 0.0021 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc | |
CVE-2026-18360 |
high | 7.6 | 0.0028 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc | |
CVE-2026-18361 |
high | 7.6 | 0.0021 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc | |
CVE-2026-72594 |
high | 7.6 | 0.0028 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low- | |
CVE-2026-68900 |
high | 7.6 | 0.0035 | 2026-08-19 | Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/ | |
CVE-2026-116167 |
high | 7.6 | 0.0066 | 2026-10-25 | SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated | |
CVE-2026-100751 |
high | 7.5 | 0.0018 | 2026-09-28 | Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Ac | |
CVE-2026-105972 |
high | 7.5 | 0.0029 | 2026-10-28 | The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item v | |
CVE-2026-40286 |
high | 7.5 | 0.0021 | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site | |
CVE-2026-46955 |
high | 7.5 | 0.0016 | 2026-06-17 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). | |
CVE-2026-53950 |
high | 7.5 | 0.0035 | 2026-06-24 | @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub clien | |
CVE-2026-65644 |
high | 7.5 | 0.0048 | 2026-08-21 | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 h | |
CVE-2026-97328 |
high | 7.5 | 0.0028 | 2026-10-22 | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser | |
CVE-2026-109936 |
high | 7.5 | 0.0028 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrit | |
CVE-2026-113499 |
high | 7.5 | 0.0030 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routin | |
CVE-2026-113500 |
high | 7.5 | 0.0030 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routin |