Export limit exceeded: 51487 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51487 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97045 | 1 Golang | 1 Net | 2026-11-04 | 6.1 Medium |
| In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. | ||||
| CVE-2026-118132 | 1 Nextchat | 1 Nextchat | 2026-11-04 | 6.1 Medium |
| NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later rendered using React’s dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema containing HTML or JavaScript markup and trick a user into loading it through the Plugin Editor, resulting in arbitrary JavaScript execution in the NextChat origin. Successful exploitation allows access to JavaScript‑readable cookies and other client‑side data associated with the NextChat application. | ||||
| CVE-2026-117538 | 1 Redaxo | 2 Core, Redaxo | 2026-11-04 | 4.1 Medium |
| REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data. | ||||
| CVE-2026-117494 | 1 Sisense | 1 Cloud Bi Platform | 2026-11-04 | N/A |
| Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript to be executed and the displayed content to be altered. | ||||
| CVE-2026-117493 | 2 Cloud Bi Platform, Sisense | 2 Sisense, Cloud Bi Platform | 2026-11-04 | N/A |
| Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context. | ||||
| CVE-2026-116887 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-04 | 5.4 Medium |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions. | ||||
| CVE-2026-116883 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-04 | 4.8 Medium |
| Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema. | ||||
| CVE-2026-116875 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-04 | 6.1 Medium |
| SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens. | ||||
| CVE-2026-97397 | 2026-11-04 | 7.2 High | ||
| The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval. | ||||
| CVE-2026-62007 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26. | ||||
| CVE-2026-57666 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1. | ||||
| CVE-2026-57639 | 2 Roland Murg, Wordpress-extensions | 2 Wp Booking System, Wp Booking System | 2026-11-04 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6. | ||||
| CVE-2026-54861 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1. | ||||
| CVE-2026-54851 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3. | ||||
| CVE-2026-119477 | 2 Jacob N. Breetvelt, Wordpress-extensions | 2 Wp Photo Album Plus, Wp Photo Album Plus | 2026-11-04 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003. | ||||
| CVE-2026-116891 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-04 | 6.1 Medium |
| SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers. | ||||
| CVE-2026-115507 | 1 Vikunja | 1 Vikunja | 2026-11-04 | 3.5 Low |
| Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members. | ||||
| CVE-2026-82161 | 1 Dell | 1 Wyse Management Suite | 2026-11-04 | 6.8 Medium |
| Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. | ||||
| CVE-2026-18449 | 1 Smci | 1 X12spi | 2026-11-04 | 7.5 High |
| The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session. | ||||
| CVE-2026-119468 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2. | ||||