Export limit exceeded: 50158 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (50158 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90918 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-10-06 | 5.3 Medium |
| Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | ||||
| CVE-2026-90914 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-10-06 | 6.4 Medium |
| Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts. | ||||
| CVE-2025-31626 | 1 Wordpress | 1 Wordpress | 2026-10-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alisaleem252 Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through 4.5.2. | ||||
| CVE-2026-66616 | 2 10web, Wordpress | 2 Form Maker By 10web, Wordpress | 2026-10-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49. | ||||
| CVE-2026-105644 | 2026-10-06 | 6.8 Medium | ||
| Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0. | ||||
| CVE-2026-102295 | 2 Red Hat, Redhat | 2 Red Hat Quay 3, Quay | 2026-10-06 | 5.4 Medium |
| A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf. | ||||
| CVE-2026-92018 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-06 | 9.6 Critical |
| Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-82924 | 2026-10-06 | 5.3 Medium | ||
| Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18. | ||||
| CVE-2026-105708 | 1 Imgproxy | 1 Imgproxy | 2026-10-06 | 4.3 Medium |
| A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-12380 | 2026-10-06 | 6.1 Medium | ||
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS. This issue affects E-Commerce Pack: through 2026-10-06. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-105809 | 1 Sourcecodester | 1 Simple Student Information System | 2026-10-06 | 4.3 Medium |
| A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-97300 | 2026-10-06 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. | ||||
| CVE-2026-39760 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. | ||||
| CVE-2026-39750 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions. | ||||
| CVE-2026-39748 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. | ||||
| CVE-2026-39745 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions. | ||||
| CVE-2026-39731 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions. | ||||
| CVE-2026-39727 | 2026-10-06 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions. | ||||
| CVE-2026-39726 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions. | ||||
| CVE-2026-39724 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions. | ||||