Lucene search
+L

1134249 matches found

NVD
NVD
added 2026/07/15 2:18 p.m.17 views

CVE-2026-59838

A improper neutralization of script-related html tags in a web page basic xss vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions,...

5.9CVSS0.00143EPSS
SaveExploits0References1
Ubuntu
Ubuntu
added 2026/07/15 2:15 p.m.11 views

USN-8551-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled authorization when multiple method constraints defined the same HTTP method. A remote attacker could possibly use this issue to bypass authorization restrictions. CVE-2026-43515 It was discovered that the Tomcat number guess example application di...

9.1CVSS7AI score0.04249EPSS
SaveExploits2
CVE
CVE
added 2026/07/15 1:43 p.m.11 views

CVE-2026-59838

CVE-2026-59838 is an XSS-type vulnerability described as improper neutralization of script-related HTML tags in Fortinet FortiSIEM. Affected versions span FortiSIEM 7.4.0; 7.3.0–7.3.4; 7.2.0–7.2.6; 7.1.x; 7.0.x; and all 6.x versions (6.4–6.7). The issue could allow an attacker to execute unauthor...

5.9CVSS6.2AI score0.00143EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/07/15 1:43 p.m.36 views

CVE-2026-59838

A improper neutralization of script-related html tags in a web page basic xss vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.2.0 through 7.2.6, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions,...

5.9CVSS0.00143EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/15 12:18 p.m.7 views

CVE-2026-61453

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

6.1CVSS0.00155EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/15 12:18 p.m.4 views

CVE-2026-56398

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

9CVSS0.00416EPSS
SaveExploits1References2
RedHat Linux
RedHat Linux
added 2026/07/15 11:42 a.m.10 views

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

8.1CVSS6.9AI score0.00471EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2026/07/15 11:42 a.m.7 views

Important: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

9.8CVSS6.5AI score0.03711EPSS
SaveExploits1References17
Cvelist
Cvelist
added 2026/07/15 11:25 a.m.33 views

CVE-2026-61453 Grav before 2.0.1 XSS via Twig String Concatenation

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

6.1CVSS0.00155EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/15 11:25 a.m.9 views

EUVD-2026-44650

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

6.1CVSS6.2AI score0.00155EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/15 11:25 a.m.8 views

CVE-2026-61453 Grav before 2.0.1 XSS via Twig String Concatenation

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

5.1CVSS6.2AI score0.00155EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/15 11:25 a.m.12 views

CVE-2026-56398

Open WebUI before 0.9.5 is vulnerable to stored XSS via the OAuth picture claim SVG data URI. The code infers MIME type from the URL extension (e.g., .svg) and ignores the server-provided Content-Type, then stores data URI labelling it as image/svg+xml. The profile image validator is bypassed in ...

9CVSS6.2AI score0.00416EPSS
SaveExploits1References2Affected Software1
EUVD
EUVD
added 2026/07/15 11:25 a.m.20 views

EUVD-2026-44628

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

8.5CVSS6.2AI score0.00416EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/07/15 11:25 a.m.38 views

CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

8.5CVSS0.00416EPSS
SaveExploits1References2
OSV
OSV
added 2026/07/15 11:25 a.m.8 views

CVE-2026-56398 Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

8.5CVSS6.2AI score0.00416EPSS
SaveExploits1References4
NVD
NVD
added 2026/07/15 10:16 a.m.12 views

CVE-2026-57833

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature...

8.6CVSS0.00318EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/15 10:16 a.m.10 views

CVE-2026-58077

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

8.7CVSS0.00318EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/07/15 9:56 a.m.7 views

CVE-2026-49459

A flaw was found in DOMPurify, a library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. A remote attacker could exploit a vulnerability in the DOMPurify.sanitize function when used with the INPLACE: true option. This flaw allows an attacker to bypass the...

6.1CVSS6.2AI score0.00303EPSS
SaveExploits1References6
RedhatCVE
RedhatCVE
added 2026/07/15 9:51 a.m.7 views

CVE-2026-49458

A flaw was found in DOMPurify, a tool designed to prevent cross-site scripting XSS attacks by sanitizing HTML, MathML, and SVG content. When processing certain types of web page elements, DOMPurify failed to properly identify and sanitize malicious code. This oversight could allow an attacker to...

6.1CVSS6.1AI score0.00384EPSS
SaveExploits1References6
RedhatCVE
RedhatCVE
added 2026/07/15 9:46 a.m.10 views

CVE-2026-47423

A flaw was found in DOMPurify, a DOM-only cross-site scripting XSS sanitizer. Due to the default allowance of selectedcontent, a remote attacker could craft a malicious payload that, after initial sanitization, could be re-cloned by browsers, leading to the execution of unsanitized markup. This...

8.2CVSS5.3AI score0.0027EPSS
SaveExploits1References6
Rows per page
Query Builder