Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (48068 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-13373 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13936.
CVE-2026-13374 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.
CVE-2026-13375 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938. This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
CVE-2026-3343 1 Watchguard 38 Firebox M270, Firebox M290, Firebox M295 and 35 more 2026-08-10 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
CVE-2026-19378 1 Code-projects 1 Task Management System 2026-08-10 4.3 Medium
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVE-2025-13939 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.
CVE-2025-13938 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.
CVE-2025-13937 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.
CVE-2025-13936 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.
CVE-2023-36892 1 Microsoft 2 Sharepoint Server, Sharepoint Server 2019 2026-08-10 8 High
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2023-36891 1 Microsoft 2 Sharepoint Server, Sharepoint Server 2019 2026-08-10 8 High
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2023-36869 1 Microsoft 4 Azure Devops Server, Azure Devops Server 2019, Azure Devops Server 2020 and 1 more 2026-08-10 6.3 Medium
Azure DevOps Server Spoofing Vulnerability
CVE-2021-40440 1 Microsoft 3 Dynamics 365 Business Central, Dynamics 365 Business Central 2020, Dynamics 365 Business Central 2021 2026-08-10 5.4 Medium
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
CVE-2021-36950 1 Microsoft 1 Dynamics 365 2026-08-10 5.4 Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2021-36946 1 Microsoft 6 Dynamics 365 Business Central, Dynamics 365 Business Central 2019, Dynamics 365 Business Central 2020 and 3 more 2026-08-10 5.4 Medium
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
CVE-2026-72594 1 Lobehub 1 Lobe Chat 2026-08-10 7.6 High
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.
CVE-2026-72576 1 Bludit 1 Bludit 2026-08-10 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.
CVE-2026-48093 2 Davidartiss, Wordpress 2 Code Embed, Wordpress 2026-08-10 6.5 Medium
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.
CVE-2026-71285 1 Louislam 1 Uptime-kuma 2026-08-10 8.1 High
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.
CVE-2026-71274 1 Openshwprojects 1 Openbk7231t App 2026-08-10 8.5 High
OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.