Lucene search
+L

1134259 matches found

CVE
CVE
added 2026/07/15 4:50 p.m.17 views

CVE-2026-62378

RustFS Console is affected in versions 0.1.7–0.1.10. The vulnerability lies in the components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path, which can render HTML content uploaded as .pdf, enabling a stored XSS in the management console. This can l...

9CVSS6AI score0.00332EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/15 4:38 p.m.40 views

CVE-2026-1563 Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

4.8CVSS0.00173EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/15 4:38 p.m.7 views

EUVD-2026-44727

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

4.8CVSS6.1AI score0.00173EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/15 4:37 p.m.7 views

EUVD-2026-44726

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

4.6CVSS6.1AI score0.00173EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/15 4:37 p.m.8 views

CVE-2026-1562

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

4.6CVSS6.1AI score0.00173EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/07/15 3:41 p.m.6 views

EUVD-2026-44706

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting XSS. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects...

5.5CVSS6.3AI score0.00258EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/15 3:41 p.m.32 views

CVE-2026-9007 Reflected XSS in HCL Notes

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting XSS. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects...

5.5CVSS0.00258EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/15 3:41 p.m.9 views

CVE-2026-9007

CVE-2026-9007 is a reflected cross-site scripting (XSS) vulnerability in HCL Notes from HCL Software. The issue stems from improper neutralization of input during web page generation, allowing an attacker to execute arbitrary JavaScript in the context of another user. Affected product/version: HC...

5.5CVSS6.3AI score0.00258EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/15 2:56 p.m.32 views

CVE-2026-41580 Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute...

6.1CVSS0.00188EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/15 2:56 p.m.12 views

CVE-2026-41580

Stirling-PDF (local web app) exposes a Reflected XSS via crafted PDF metadata in the /get-info-on-pdf endpoint. Prior to version 2.0.0, Title and Author metadata were rendered without proper HTML encoding/sanitization, allowing attacker-controlled JavaScript to execute in a user’s browser when vi...

6.1CVSS6.2AI score0.00188EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/15 2:18 p.m.17 views

CVE-2026-59838

A improper neutralization of script-related html tags in a web page basic xss vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions,...

5.9CVSS0.00143EPSS
SaveExploits0References1
Ubuntu
Ubuntu
added 2026/07/15 2:15 p.m.11 views

USN-8551-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined the same HTTP method. A remote attacker could possibly use this issue to bypass authorization restrictions. CVE-2026-43515 It was discovered that the Tomcat number guess example application di...

9.1CVSS7AI score0.04249EPSS
SaveExploits2
CVE
CVE
added 2026/07/15 1:43 p.m.11 views

CVE-2026-59838

CVE-2026-59838 is an XSS-type vulnerability described as improper neutralization of script-related HTML tags in Fortinet FortiSIEM. Affected versions span FortiSIEM 7.4.0; 7.3.0–7.3.4; 7.2.0–7.2.6; 7.1.x; 7.0.x; and all 6.x versions (6.4–6.7). The issue could allow an attacker to execute unauthor...

5.9CVSS6.2AI score0.00143EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/07/15 1:43 p.m.36 views

CVE-2026-59838

A improper neutralization of script-related html tags in a web page basic xss vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions,...

5.9CVSS0.00143EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/15 12:18 p.m.7 views

CVE-2026-61453

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

6.1CVSS0.00155EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/15 12:18 p.m.4 views

CVE-2026-56398

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

9CVSS0.00416EPSS
SaveExploits1References2
RedHat Linux
RedHat Linux
added 2026/07/15 11:42 a.m.10 views

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

8.1CVSS6.9AI score0.00471EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2026/07/15 11:42 a.m.7 views

Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

9.8CVSS6.5AI score0.03711EPSS
SaveExploits1References17
Cvelist
Cvelist
added 2026/07/15 11:25 a.m.33 views

CVE-2026-61453 Grav before 2.0.1 XSS via Twig String Concatenation

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

6.1CVSS0.00155EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/15 11:25 a.m.9 views

EUVD-2026-44650

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

6.1CVSS6.2AI score0.00155EPSS
SaveExploits0References2
Rows per page
Query Builder