2026

SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a m

SPIP before 4.4.8 allows cross-site scripting (XSS) in the private area via malicious iframe tags. The application does

SPIP before 4.4.9 allows Cross-Site Scripting (XSS) in the private area, complementing an incomplete fix from SPIP 4.4.8

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.18.0 through 1.18.

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable

WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnera

A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to exe

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query p

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search q

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in radiomobile_front.php via the

SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user registration workflow (i

SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow

Fiverr Clone Script 1.2.2 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject

HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which wo

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape ht

OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious script

phpMoAdmin 1.1.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject

phpMoAdmin 1.1.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject ma

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Versions 5.0.3

Pannellum is a lightweight, free, and open source panorama viewer for the web. In versions 3.5.0 through 2.5.6, the hot

Isso is a lightweight commenting server written in Python and JavaScript. In commits before 0afbfe0691ee237963e8fb0b2ee0

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the adm

Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, w

WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses P

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior reflect unsanitized user input in the we

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side

A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access an

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` compon

The SPIP jeux plugin versions prior to 4.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the pre_pro

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-wat

BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received wi

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific da

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulne

Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textConte

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includin

A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebSc

An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of P

Some HTTP security headers are not properly set by the web server when sending responses to the client application.

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 throu

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', in 'a3factura-app.wolterskluwer

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'name', parameter 'name', in 'a3factura

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerName', in 'a3factura-app.wolte

Reflected Cross-Site Scripting (XSS) on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.

A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null poi

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name c