Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:79"
1,807 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-18526 |
high | 7.4 | 0.0046 | 2026-08-19 | HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerabi | |
CVE-2026-48294 |
high | 7.4 | 0.0191 | 2026-06-17 | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cros | |
CVE-2026-55790 |
high | 7.4 | 0.0046 | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 t | |
CVE-2026-64900 |
high | 7.3 | 0.0065 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55021 |
high | 7.3 | 0.0095 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55034 |
high | 7.3 | 0.0095 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55126 |
high | 7.3 | 0.0065 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-62914 |
high | 7.3 | 0.0045 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex | |
CVE-2026-70355 |
high | 7.3 | 0.0078 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-88204 |
high | 7.3 | 0.0063 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-33044 |
high | 7.3 | 0.0023 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. St | |
CVE-2026-33045 |
high | 7.3 | 0.0021 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. St | |
CVE-2026-3877 |
high | 7.3 | 0.0019 | 2026-04-01 | A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the Ve | |
CVE-2025-61312 |
high | 7.3 | 0.0029 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Me | |
CVE-2025-61313 |
high | 7.3 | 0.0029 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_markeralerts.php component of Gm | |
CVE-2025-61314 |
high | 7.3 | 0.0029 | 2026-05-11 | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_orderopt.php component of GmbH M | |
CVE-2026-45011 |
high | 7.3 | 0.0027 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross | |
CVE-2026-53987 |
high | 7.3 | 0.0050 | 2026-07-09 | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders i | |
CVE-2026-55081 |
high | 7.3 | 0.0044 | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visua | |
CVE-2025-63417 |
high | 7.2 | 0.0025 | 2025-11-05 | A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform | |
CVE-2026-18756 |
high | 7.2 | 0.0047 | 2026-08-19 | HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space | |
CVE-2026-18430 |
high | 7.2 | 0.0047 | 2026-08-19 | HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notificat | |
CVE-2026-111820 |
high | 7.2 | 0.0024 | 2026-10-27 | The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable | |
CVE-2026-109995 |
high | 7.2 | 0.0024 | 2026-10-27 | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable | |
CVE-2026-109999 |
high | 7.2 | 0.0029 | 2026-10-28 | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automa | |
CVE-2026-111314 |
high | 7.2 | 0.0024 | 2026-10-28 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vul | |
CVE-2026-97019 |
high | 7.2 | 0.0024 | 2026-10-28 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Sc | |
CVE-2026-110662 |
high | 7.2 | 0.0031 | 2026-10-28 | The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Sto | |
CVE-2026-111111 |
high | 7.2 | 0.0024 | 2026-10-28 | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for Word | |
CVE-2026-116796 |
high | 7.2 | 0.0034 | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 1 | |
CVE-2026-118244 |
high | 7.2 | 0.0034 | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Hi | |
CVE-2026-118257 |
high | 7.2 | 0.0027 | 2026-10-28 | Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-a | |
CVE-2026-96666 |
high | 7.2 | 0.0030 | 2026-10-29 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-96669 |
high | 7.2 | 0.0030 | 2026-10-29 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Si | |
CVE-2026-96741 |
high | 7.2 | 0.0024 | 2026-10-29 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Co | |
CVE-2026-58298 |
high | 7.2 | 0.0041 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ed | |
CVE-2026-42650 |
high | 7.2 | 0.0019 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions. | |
CVE-2026-8141 |
high | 7.2 | 0.0032 | 2026-06-30 | The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | |
CVE-2026-58263 |
high | 7.2 | 0.0022 | 2026-07-01 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4 | |
CVE-2026-75091 |
high | 7.2 | 0.0032 | 2026-08-18 | The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnera | |
CVE-2026-107743 |
high | 7.2 | 0.0040 | 2026-10-29 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up | |
CVE-2026-109987 |
high | 7.2 | 0.0024 | 2026-10-22 | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 | |
CVE-2026-109198 |
high | 7.2 | 0.0038 | 2026-10-23 | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to S | |
CVE-2026-115821 |
high | 7.2 | — | 2026-10-29 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_fi | |
CVE-2026-96767 |
high | 7.2 | — | 2026-10-29 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cro | |
CVE-2026-68567 |
high | 7.1 | 0.0025 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-66581 |
high | 7.1 | 0.0025 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. | |
CVE-2026-66590 |
high | 7.1 | 0.0025 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. | |
CVE-2026-102636 |
high | 7.1 | 0.0015 | 2026-10-27 | A maliciously crafted HTML payload in a design name, when displayed after another user opens the man | |
CVE-2026-102637 |
high | 7.1 | 0.0015 | 2026-10-27 | A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the |