Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

High7.6Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Software Design Industry and Trade Ltd.CVE-2026-5783 · CVE.org · NIST NVDMay 20, 2026
Medium5.3The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows…CVE-2026-4293 · CVE.org · NIST NVDMay 20, 2026
Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Stored XSS.CVE-2026-24573 · CVE.org · NIST NVDMay 20, 2026
Medium6.4The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and…CVE-2026-2955 · CVE.org · NIST NVD · WordPressMay 20, 2026
High7.4mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager.CVE-2026-7460 · CVE.org · NIST NVDMay 20, 2026
Medium6.1The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in versions up to and including 1.0.CVE-2026-8627 · CVE.org · NIST NVD · PHP, WordPressMay 20, 2026
Medium6.1The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficie…CVE-2026-8626 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium6.1The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97…CVE-2026-8624 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium6.4The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in all versi…CVE-2026-8038 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium6.1The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 1.01.CVE-2026-7462 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium6.4The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the , , and shortcodes in all versions up to…CVE-2026-6549 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium4.4The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versions up to…CVE-2026-6404 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium4.4The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0.CVE-2026-6399 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium6.4The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode attribute in versions up to and including 2.5.6.CVE-2026-6397 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium6.4The 診断ジェネレータ作成プラグイン (Diagnosis Generator) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16.CVE-2026-5293 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium5.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).CVE-2026-8493 · colorbox inline project · colorbox inline · CVE.org · NIST NVD · DrupalMay 19, 2026
Medium6.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS).CVE-2026-6871 · obfuscate project · obfuscate · CVE.org · NIST NVD · DrupalMay 19, 2026
Medium6.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).CVE-2026-6095 · gaya · orejime · CVE.org · NIST NVD · DrupalMay 19, 2026
Medium6.1Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected.CVE-2026-5090 · CVE.org · NIST NVDMay 19, 2026
High8.6Mantis Bug Tracker (MantisBT) is an open source issue tracker.CVE-2026-34463 · CVE.org · NIST NVDMay 19, 2026
High8.7CtrlPanel is open-source billing software for hosting providers.CVE-2026-34241 · CVE.org · NIST NVDMay 19, 2026
Medium6.8EspoCRM is an open source customer relationship management application.CVE-2026-33741 · CVE.org · NIST NVDMay 19, 2026
Critical9.1Same-origin policy bypass in the DOM: Networking component.CVE-2026-8948 · mozilla · firefox · CVE.org · FIRST EPSS · NIST NVD · FirefoxEPSS 0.5%May 19, 2026
Medium5.1A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter.CVE-2025-40904 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026
Medium4.8A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter.CVE-2025-40903 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026