Browse CVEs

MEDIUM 6.1 CVE-2026-14845 The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and … No fix yet Fix from $1,6002026-07-31 HIGH 8.8 CVE-2026-13609 The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which rest… Mitigation only Fix from $1,9502026-07-31 HIGH 8.2 CVE-2026-56672 ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with e… Patch available Fix from $1,9502026-07-31 HIGH 8.2 CVE-2026-56670 ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files… Patch available Fix from $1,9502026-07-31 CRITICAL 9.3 CVE-2026-66421 OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript … No fix yet Fix from $2,3002026-07-30 MEDIUM 6.1 CVE-2026-61526 AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.… Patch available Fix from $1,6002026-07-30 CRITICAL 9.3 CVE-2026-66418 OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML … No fix yet Fix from $2,3002026-07-30 MEDIUM 6.1 CVE-2025-65341 Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2025-65342 code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2025-51684 CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessa… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2025-0152 IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site… Engineering Requirements Management Doors Web Access after 9.7.2.11 Fix from $1,6002026-07-30 CRITICAL 9.3 CVE-2026-11707 IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the … Websphere Application Server Mitigation only Fix from $2,3002026-07-30 MEDIUM 5.4 CVE-2025-36431 IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. … Sterling B2b Integrator No fix yet Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2026-11383 IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative C… Websphere Application Server No fix yet Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2025-36298 IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM St… Sterling B2b Integrator No fix yet Fix from $1,6002026-07-30 HIGH 7.6 CVE-2026-18360 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. No fix yet Fix from $1,9502026-07-30 HIGH 7.6 CVE-2026-18361 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. No fix yet Fix from $1,9502026-07-30 HIGH 7.6 CVE-2026-16969 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. No fix yet Fix from $1,9502026-07-30 HIGH 7.1 CVE-2026-14239 The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and do… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.8 CVE-2026-14318 The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-14592 The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option v… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-13330 The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upl… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-14207 The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, a… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-11881 The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-17962 Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) vi… Chrome 151.0.7922.72+ Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2026-17903 Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scri… Chrome 151.0.7922.72+ Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-17878 Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via … Chrome 151.0.7922.72+ Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-17845 Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via … Chrome 151.0.7922.72+ Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-17853 Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process t… Chrome 151.0.7922.72+ Fix from $1,6002026-07-30 MEDIUM 6.1 CVE-2026-17827 Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via … Chrome 151.0.7922.72+ Fix from $1,6002026-07-30