Export limit exceeded: 419300 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51451 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63157 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-10-27 | 5.4 Medium |
| Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise. | ||||
| CVE-2026-63156 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-10-27 | 6.1 Medium |
| Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php. | ||||
| CVE-2026-63148 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-10-27 | 5.4 Medium |
| Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page. | ||||
| CVE-2026-63147 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-10-27 | 5.4 Medium |
| Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers. | ||||
| CVE-2026-116802 | 1 Cure53 | 1 Dompurify | 2026-10-27 | 6.1 Medium |
| DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link. | ||||
| CVE-2026-104083 | 1 Smartertools | 1 Smartermail | 2026-10-27 | 6.1 Medium |
| SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy. | ||||
| CVE-2026-104078 | 1 Obsidian | 2 Obsidian, Obsidian Desktop | 2026-10-27 | 7.8 High |
| Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user. | ||||
| CVE-2026-104077 | 1 Obsidian | 2 Obsidian, Obsidian Desktop | 2026-10-27 | 7.8 High |
| Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin, allowing a javascript: URL to execute in the resulting background iframe. Because Node integration is enabled and context isolation is disabled in Obsidian's vault renderer, the injected script can call parent.require() to access Node APIs such as fs and child_process, enabling arbitrary operating system command execution when the victim opens the note and manually starts the presentation. | ||||
| CVE-2026-104073 | 2 Netbox, Netbox-community | 2 Netbox, Netbox | 2026-10-27 | 7.6 High |
| NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover. | ||||
| CVE-2025-69723 | 1 Localstack | 1 Localstack | 2026-10-27 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL. | ||||
| CVE-2026-90848 | 1 Governikus | 1 Ausweisapp | 2026-10-26 | 4.3 Medium |
| A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5 is able to address this issue. It is recommended to upgrade the affected component. This CVE was requested by the vendor. | ||||
| CVE-2026-39727 | 2 Saravana Kumar K, Wordpress-extensions | 2 Wc Fields Factory, Wc Fields Factory | 2026-10-26 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions. | ||||
| CVE-2026-55876 | 1 Heliumedu | 1 Platform | 2026-10-26 | 3.5 Low |
| Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60. | ||||
| CVE-2026-55872 | 1 Mayerbalintdev | 1 Gym-one | 2026-10-26 | 8.7 High |
| GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1. | ||||
| CVE-2026-50095 | 1 Esri | 1 Arcgis Server | 2026-10-26 | 6.1 Medium |
| There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch. | ||||
| CVE-2026-116385 | 1 Bdtask | 1 Garage 24 Garage Management Software | 2026-10-26 | 3.5 Low |
| A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit_profile of the component Profile. The manipulation of the argument first_name/last_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-33520 | 1 Esri | 1 Arcgis Server | 2026-10-26 | 6.1 Medium |
| There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for impacted ArcGIS Server software in General Availability and Extended support status, which includes versions 11.5. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch. | ||||
| CVE-2026-50096 | 1 Esri | 1 Arcgis Server | 2026-10-26 | 6.1 Medium |
| There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch. | ||||
| CVE-2026-109193 | 2 Hivepress, Wordpress-extensions | 2 Hivepress – Business Directory, Listings & Classified Ads Plugin, Hivepress | 2026-10-26 | 7.2 High |
| The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature. | ||||
| CVE-2026-95717 | 1 Hpe | 1 Aos | 2026-10-26 | 5.5 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session. | ||||