Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Low2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationEPSS 0.2%Oct 12, 2026
- Low2.0A vulnerability was detected in Netis WF2409E 3.3.42541.EPSS 0.2%Oct 12, 2026
- High8.7A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code i…EPSS 0.2%Oct 12, 2026
- High8.7A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code i…EPSS 0.2%Oct 12, 2026
- Medium4.8An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the brows…Oct 12, 2026
- Low2.0A weakness has been identified in y_project RuoYi up to 4.8.3.EPSS 0.2%Oct 12, 2026
- High8.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could haveEPSS 0.3%Oct 12, 2026
- Medium6.4The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen pos…EPSS 0.2%Oct 10, 2026
- Critical9.3Contao: Cross-site scripting in the comments bundleEPSS 0.3%Oct 9, 2026
- Medium6.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.Oct 8, 2026
- Medium6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.Oct 8, 2026
- Medium5.1jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalid…EPSS 0.2%Oct 8, 2026
- Medium4.4Indico: Cross-Site-Scripting in minutes editorEPSS 0.2%Oct 8, 2026
- Medium5.4IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting.EPSS 0.2%Oct 8, 2026
- Medium6.5In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to per…EPSS 0.2%Oct 8, 2026
- Medium5.4Gitea container registry stored XSS through blob media typeEPSS 0.2%Oct 6, 2026
- High8.7Payload is a free and open source headless content management system.EPSS 0.3%Oct 6, 2026
- Medium5.3Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.EPSS 0.3%Oct 6, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected X…EPSS 0.2%Oct 6, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.Thi…EPSS 0.1%Oct 5, 2026
- Medium5.3Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values ar…EPSS 0.2%Oct 5, 2026
- Medium6.4The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3…EPSS 0.2%Oct 3, 2026
- Medium6.4The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to…EPSS 0.2%Sep 30, 2026
- Medium6.1Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationEPSS 0.3%Sep 29, 2026
- Medium6.4The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and includin…EPSS 0.2%Sep 25, 2026