Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (48292 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-74892 2026-08-18 7.5 High
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.
CVE-2026-73378 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73375 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73359 2026-08-18 6.5 Medium
Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
CVE-2026-73342 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
CVE-2026-73338 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
CVE-2026-66667 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
CVE-2026-66645 2026-08-18 6.5 Medium
Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
CVE-2026-66643 2026-08-18 6.5 Medium
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
CVE-2026-66641 2026-08-18 6.5 Medium
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
CVE-2026-66639 2026-08-18 6.5 Medium
Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.
CVE-2026-66636 2026-08-18 6.5 Medium
Contributor Cross Site Scripting (XSS) in Wise Chat <= 3.4 versions.
CVE-2026-66621 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions.
CVE-2026-55674 1 Discourse 1 Discourse 2026-08-18 9.3 Critical
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
CVE-2026-28569 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
CVE-2026-19447 2026-08-18 5.4 Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5.
CVE-2026-75831 1 Getgrav 1 Grav 2026-08-18 7.6 High
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
CVE-2026-75828 1 Getgrav 1 Grav 2026-08-18 8.7 High
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.
CVE-2026-75077 1 Sourcecodester 1 Class And Exam Timetabling System 2026-08-18 4.3 Medium
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
CVE-2026-11383 3 Ibm, Linux, Microsoft 7 Aix, I, Tivoli System Automation Application Manager and 4 more 2026-08-18 5.4 Medium
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.