Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

Medium4.8A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter.CVE-2025-40902 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026
Medium4.8A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter.CVE-2025-40901 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026
Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.CVE-2026-31906 · apache · ofbiz · CVE.org · FIRST EPSS · NIST NVD · ApacheEPSS 0.6%May 19, 2026
Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), I…CVE-2026-31379 · apache · ofbiz · CVE.org · FIRST EPSS · NIST NVD · ApacheEPSS 0.7%May 19, 2026
Low3.9FacturaScripts is an open source accounting and invoicing software.CVE-2026-27964 · CVE.org · NIST NVDMay 18, 2026
Medium6.5BigBlueButton is an open-source virtual classroom.CVE-2026-27737 · CVE.org · NIST NVDMay 18, 2026
Medium5.3DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that ar…CVE-2026-45231 · CVE.org · NIST NVDMay 18, 2026
Medium6.1Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2026-45494 · microsoft · edge chromium · CVE.org · FIRST EPSS · NIST NVD · Chrome, EdgeEPSS 0.3%May 18, 2026
Medium6.1HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input…CVE-2026-29965 · hsclabs · mailinspector · CVE.org · NIST NVDMay 18, 2026
Medium6.1HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input usi…CVE-2026-29964 · hsclabs · mailinspector · CVE.org · NIST NVDMay 18, 2026
High8.8Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology Consulting and Organization Trade Ltd.CVE-2026-7498 · CVE.org · NIST NVDMay 18, 2026
Medium4.8Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows…CVE-2026-3495 · mattermost · mattermost server · CVE.org · FIRST EPSS · NIST NVDEPSS 0.1%May 18, 2026
High7.1The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scri…CVE-2026-6495 · CVE.org · NIST NVD · WordPressMay 18, 2026
High8.8The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenti…CVE-2026-3220 · CVE.org · NIST NVD · WordPressMay 18, 2026
Medium5.1Zenar Content Management System contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating form pa…CVE-2018-25331 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 17, 2026
Medium5.1Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS paylo…CVE-2021-47981 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
Medium5.1WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the parameter.CVE-2021-47975 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
Medium5.1Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized inp…CVE-2021-47957 · CVE.org · FIRST EPSS · NIST NVD · WordPressEPSS 0.2%May 16, 2026
Medium5.1CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files throu…CVE-2021-47955 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
Medium6.9MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user p…CVE-2021-47934 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
High8.7Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by in…CVE-2020-37245 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.5%May 16, 2026
Medium5.1Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user cr…CVE-2020-37240 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
Medium5.1CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts thr…CVE-2020-37238 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
Medium5.1Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner ma…CVE-2020-37237 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
Medium5.1NewsLister contains an authenticated persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the tit…CVE-2020-37236 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026