Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

Medium5.1WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by…CVE-2020-37235 · CVE.org · FIRST EPSS · NIST NVD · WordPressEPSS 0.2%May 16, 2026
Medium5.1WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject mali…CVE-2020-37233 · CVE.org · FIRST EPSS · NIST NVD · WordPressEPSS 0.3%May 16, 2026
Low2.0Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values…CVE-2026-8656 · CVE.org · NIST NVDMay 16, 2026
High8.1Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-45665 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
Medium5.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-45318 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
High8.7Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-45315 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
High7.7Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-45303 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
Medium5.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-45299 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
High8.7Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-44549 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
High7.3Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-44721 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
Medium4.8Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.CVE-2026-44568 · openwebui · open webui · CVE.org · NIST NVDMay 15, 2026
High8.3phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments.CVE-2026-46367 · CVE.org · NIST NVDMay 15, 2026
Medium5.1phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles.CVE-2026-46363 · CVE.org · NIST NVDMay 15, 2026
High8.2phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filt…CVE-2026-46361 · CVE.org · NIST NVDMay 15, 2026
Medium5.1phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations,…CVE-2026-46360 · CVE.org · NIST NVDMay 15, 2026
Medium5.3Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-45622 · CVE.org · NIST NVDMay 15, 2026
Medium5.1Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-45616 · CVE.org · NIST NVDMay 15, 2026
Medium6.1Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-44366 · CVE.org · NIST NVDMay 15, 2026
Medium5.1Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JavaScrip…CVE-2021-47968 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 15, 2026
Medium5.1PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths…CVE-2021-47967 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 15, 2026
Medium5.1Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files…CVE-2021-47963 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.5%May 15, 2026
Medium5.1Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows authenticated attackers to inject malicious HTM…CVE-2021-47962 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 15, 2026
Medium5.1Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, wh…CVE-2026-23695 · CVE.org · NIST NVDMay 15, 2026
Medium6.4The Advanced Custom Fields: Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.0.2.CVE-2026-6415 · CVE.org · NIST NVD · WordPressMay 15, 2026
Medium6.4The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2.CVE-2026-6646 · CVE.org · NIST NVD · WordPressMay 15, 2026