Browse CVEs

CRITICAL 9.6 CVE-2026-55008 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to … Exchange Server 15.02.2562.045+ Fix from $2,3002026-07-14 CRITICAL 10.0 CVE-2026-54433 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The att… Webmail 1.6.17 / 1.7.2+ Fix from $2,3002026-07-14 MEDIUM 6.4 CVE-2026-36214 osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component … Patch available Fix from $1,6002026-07-14 HIGH 8.4 CVE-2026-9292 A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralizati… Mitigation only Fix from $1,9502026-07-14 MEDIUM 6.1 CVE-2026-23573 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.… Fortiproxy 1.8.1 / 7.2.10+ Fix from $1,6002026-07-14 MEDIUM 6.1 CVE-2026-58475 Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attacke… Sustainable Irrigation Platform after 5.2.16 Fix from $1,6002026-07-14 MEDIUM 6.4 CVE-2026-7640 The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-conte… Mitigation only Fix from $1,6002026-07-14 MEDIUM 6.4 CVE-2026-11390 The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets… Mitigation only Fix from $1,6002026-07-14 MEDIUM 6.1 CVE-2026-44767 setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used d… Mitigation only Fix from $1,6002026-07-14 HIGH 8.2 CVE-2026-44752 SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses … Mitigation only Fix from $1,9502026-07-14 MEDIUM 6.1 CVE-2026-44759 SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the… Mitigation only Fix from $1,6002026-07-14 HIGH 7.0 CVE-2026-58411 ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insuf… Mitigation only Fix from $1,9502026-07-13 MEDIUM 5.1 CVE-2026-58487 HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part o… Mitigation only Fix from $1,6002026-07-13 HIGH 8.2 CVE-2026-58500 MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, t… Patch available Fix from $1,9502026-07-13 MEDIUM 6.4 CVE-2026-12536 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, … Mitigation only Fix from $1,6002026-07-13 MEDIUM 5.1 CVE-2026-58228 Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in… Patch available Fix from $1,6002026-07-13 MEDIUM 6.1 CVE-2026-49971 Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary … Patch available Fix from $1,6002026-07-13 MEDIUM 6.1 CVE-2026-61501 Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can s… Mitigation only Fix from $1,6002026-07-13 MEDIUM 5.4 CVE-2026-61504 Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the… Mitigation only Fix from $1,6002026-07-13 MEDIUM 5.1 CVE-2026-4765 Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initializa… Mitigation only Fix from $1,6002026-07-13 HIGH 7.1 CVE-2026-57814 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform F… Mitigation only Fix from $1,9502026-07-13 HIGH 7.1 CVE-2026-57816 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-bu… Mitigation only Fix from $1,9502026-07-13 HIGH 7.1 CVE-2026-59516 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics… Mitigation only Fix from $1,9502026-07-13 MEDIUM 6.5 CVE-2026-57780 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-… Mitigation only Fix from $1,6002026-07-13 MEDIUM 6.5 CVE-2026-57783 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.Thi… Mitigation only Fix from $1,6002026-07-13 HIGH 7.1 CVE-2026-57741 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP News… Mitigation only Fix from $1,9502026-07-13 HIGH 7.1 CVE-2026-57745 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions… Mitigation only Fix from $1,9502026-07-13 HIGH 7.1 CVE-2026-57725 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issu… Mitigation only Fix from $1,9502026-07-13 HIGH 7.1 CVE-2026-57728 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XS… Mitigation only Fix from $1,9502026-07-13 HIGH 7.1 CVE-2026-57732 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription al… Mitigation only Fix from $1,9502026-07-13