Export limit exceeded: 48206 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48206 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13376 | 1 Watchguard | 40 Firebox M270, Firebox M290, Firebox M295 and 37 more | 2026-08-10 | 4.8 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2. | ||||
| CVE-2026-13373 | 1 Watchguard | 40 Firebox M270, Firebox M290, Firebox M295 and 37 more | 2026-08-10 | 4.8 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13936. | ||||
| CVE-2026-13374 | 1 Watchguard | 40 Firebox M270, Firebox M290, Firebox M295 and 37 more | 2026-08-10 | 4.8 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937. | ||||
| CVE-2026-13375 | 1 Watchguard | 40 Firebox M270, Firebox M290, Firebox M295 and 37 more | 2026-08-10 | 4.8 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938. This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2. | ||||
| CVE-2026-3343 | 1 Watchguard | 38 Firebox M270, Firebox M290, Firebox M295 and 35 more | 2026-08-10 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link. | ||||
| CVE-2026-19378 | 1 Code-projects | 1 Task Management System | 2026-08-10 | 4.3 Medium |
| A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. | ||||
| CVE-2025-13939 | 1 Watchguard | 35 Firebox M270, Firebox M290, Firebox M370 and 32 more | 2026-08-10 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS. | ||||
| CVE-2025-13938 | 1 Watchguard | 35 Firebox M270, Firebox M290, Firebox M370 and 32 more | 2026-08-10 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. | ||||
| CVE-2025-13937 | 1 Watchguard | 35 Firebox M270, Firebox M290, Firebox M370 and 32 more | 2026-08-10 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. | ||||
| CVE-2025-13936 | 1 Watchguard | 35 Firebox M270, Firebox M290, Firebox M370 and 32 more | 2026-08-10 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS. | ||||
| CVE-2023-36892 | 1 Microsoft | 2 Sharepoint Server, Sharepoint Server 2019 | 2026-08-10 | 8 High |
| Microsoft SharePoint Server Spoofing Vulnerability | ||||
| CVE-2023-36891 | 1 Microsoft | 2 Sharepoint Server, Sharepoint Server 2019 | 2026-08-10 | 8 High |
| Microsoft SharePoint Server Spoofing Vulnerability | ||||
| CVE-2023-36869 | 1 Microsoft | 4 Azure Devops Server, Azure Devops Server 2019, Azure Devops Server 2020 and 1 more | 2026-08-10 | 6.3 Medium |
| Azure DevOps Server Spoofing Vulnerability | ||||
| CVE-2021-40440 | 1 Microsoft | 3 Dynamics 365 Business Central, Dynamics 365 Business Central 2020, Dynamics 365 Business Central 2021 | 2026-08-10 | 5.4 Medium |
| Microsoft Dynamics Business Central Cross-site Scripting Vulnerability | ||||
| CVE-2021-36950 | 1 Microsoft | 1 Dynamics 365 | 2026-08-10 | 5.4 Medium |
| Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | ||||
| CVE-2021-36946 | 1 Microsoft | 6 Dynamics 365 Business Central, Dynamics 365 Business Central 2019, Dynamics 365 Business Central 2020 and 3 more | 2026-08-10 | 5.4 Medium |
| Microsoft Dynamics Business Central Cross-site Scripting Vulnerability | ||||
| CVE-2026-72594 | 1 Lobehub | 1 Lobe Chat | 2026-08-10 | 7.6 High |
| A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar. | ||||
| CVE-2026-72576 | 1 Bludit | 1 Bludit | 2026-08-10 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo. | ||||
| CVE-2026-48093 | 2 Davidartiss, Wordpress | 2 Code Embed, Wordpress | 2026-08-10 | 6.5 Medium |
| The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1. | ||||
| CVE-2026-71285 | 1 Louislam | 1 Uptime-kuma | 2026-08-10 | 8.1 High |
| Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover. | ||||