Export limit exceeded: 50585 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (50585 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102859 | 1 Microsoft | 1 Sharepoint Server | 2026-10-13 | 4.6 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-110228 | 1 Wallabag | 1 Wallabag | 2026-10-13 | 5.4 Medium |
| wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the predictable /uploads/import/<user-id>.html path to execute script in victims' wallabag sessions. | ||||
| CVE-2026-110221 | 1 Webkul | 1 Qloapps | 2026-10-13 | 5.4 Medium |
| QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session. | ||||
| CVE-2026-104816 | 2026-10-13 | N/A | ||
| Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0. | ||||
| CVE-2026-109558 | 1 Tianma-if | 1 Edgeever | 2026-10-13 | 8.7 High |
| EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge. | ||||
| CVE-2026-109355 | 1 Librenms | 1 Librenms | 2026-10-13 | 6.1 Medium |
| LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page. | ||||
| CVE-2026-109345 | 1 Cure53 | 1 Dompurify | 2026-10-13 | 6.1 Medium |
| DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node. | ||||
| CVE-2026-109744 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109747 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-55562 | 1 Jhuckaby | 1 Cronicle | 2026-10-13 | 9 Critical |
| Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119. | ||||
| CVE-2026-96594 | 1 Gitea | 1 Gitea | 2026-10-13 | 6.1 Medium |
| The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions. | ||||
| CVE-2020-12811 | 1 Fortinet | 2 Fortianalyzer, Fortimanager | 2026-10-13 | 4.9 Medium |
| A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2026-63356 | 2026-10-13 | 6.1 Medium | ||
| Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed. | ||||
| CVE-2026-63351 | 2026-10-13 | 6.1 Medium | ||
| Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization. | ||||
| CVE-2026-109673 | 1 Frappe | 1 Erpnext | 2026-10-13 | 7.3 High |
| Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users. | ||||
| CVE-2026-109653 | 1 Frappe | 1 Erpnext | 2026-10-13 | 7.3 High |
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover. | ||||
| CVE-2026-109633 | 1 Frappe | 1 Erpnext | 2026-10-13 | 8.1 High |
| Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account. | ||||
| CVE-2026-109602 | 1 Frappe | 1 Frappe | 2026-10-13 | 5.4 Medium |
| Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart. | ||||
| CVE-2026-109597 | 1 Gohugo | 1 Hugo | 2026-10-13 | 5.4 Medium |
| Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages. | ||||
| CVE-2026-109344 | 1 Cure53 | 1 Dompurify | 2026-10-13 | 6.1 Medium |
| DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin. | ||||