1243870 matches found
CVE-2026-102427 Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...
EUVD-2026-89995
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...
CVE-2026-102427
The OrdaSoft Joomla CCK extension (versions
SUSE CVE-2026-102329
Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: High...
EUVD-2026-89965
MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...
CVE-2026-103389 MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...
CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...
CVE-2026-97301
Contributor Cross Site Scripting XSS in Cool Formkit Lite = 2.7.8 versions...
CVE-2026-97279
Contributor Cross Site Scripting XSS in Polylang = 3.8.9 versions...
CVE-2026-97286
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11...
CVE-2026-97266
Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12.1 versions...
CVE-2026-97067
Contributor Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.7 versions...
CVE-2026-96450
Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...
CVE-2026-94077
Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...
CVE-2026-94078
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.3.1 versions...
CVE-2026-62078
Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...
CVE-2026-102398 WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
CVE-2026-102384 WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in Supreme Modules Lite = 2.5.63 versions...
CVE-2026-102384
The WordPress Supreme Modules Lite plugin in versions
CVE-2026-100513 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.5 versions...