Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (51214 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-116850 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
CVE-2026-110881 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.
CVE-2026-116849 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.
CVE-2026-39737 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.
CVE-2026-115610 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.
CVE-2026-5700 1 Sabbatic 1 Sabbatic App 2026-10-29 N/A
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows:  parameter 'observaciones' in  /mis-gastos  endpoint.
CVE-2026-5699 1 Sabbatic 1 Sabbatic App 2026-10-29 N/A
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows:   parameter 'companyName' in  /empresa  endpoint;
CVE-2026-5698 1 Sabbatic 1 Sabbatic App 2026-10-29 N/A
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows:  parameters 'titulo_es' and 'add_etiquetas%5B%5D' in '/categorías' endpoint;
CVE-2026-5697 1 Sabbatic 1 Sabbatic App 2026-10-29 N/A
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows:   parameter 'nombre' in '/usuario' endpoint;
CVE-2026-56056 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.
CVE-2026-54862 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.
CVE-2026-52709 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.
CVE-2026-48196 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.
CVE-2026-48195 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.
CVE-2026-24533 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.
CVE-2026-118087 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.
CVE-2026-115957 2026-10-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Stored XSS.This issue affects WP Discussion Board: from n/a through 2.6.0.
CVE-2026-115730 1 I18next 1 I18next-http-backend 2026-10-29 3.1 Low
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
CVE-2026-115609 2026-10-29 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.
CVE-2026-115606 2026-10-29 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1.