Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (51640 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-16535 2 Link Library Project, Wordpress 2 Link Library, Wordpress 2026-08-10 6.1 Medium
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
CVE-2026-13377 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS SIP Proxy module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-6947.
CVE-2026-13376 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
CVE-2026-13373 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13936.
CVE-2026-13374 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.
CVE-2026-13375 1 Watchguard 40 Firebox M270, Firebox M290, Firebox M295 and 37 more 2026-08-10 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13938. This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
CVE-2026-3343 1 Watchguard 38 Firebox M270, Firebox M290, Firebox M295 and 35 more 2026-08-10 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in the Fireware OS Web UI enabled execution of malicious JavaScript in the context of an authenticated management user's browser when they click on a specially crafted link.
CVE-2026-19378 1 Code-projects 1 Task Management System 2026-08-10 4.3 Medium
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVE-2025-13939 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.
CVE-2025-13938 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.
CVE-2025-13937 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.
CVE-2025-13936 1 Watchguard 35 Firebox M270, Firebox M290, Firebox M370 and 32 more 2026-08-10 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.
CVE-2023-36892 1 Microsoft 2 Sharepoint Server, Sharepoint Server 2019 2026-08-10 8 High
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2023-36891 1 Microsoft 2 Sharepoint Server, Sharepoint Server 2019 2026-08-10 8 High
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2023-36869 1 Microsoft 4 Azure Devops Server, Azure Devops Server 2019, Azure Devops Server 2020 and 1 more 2026-08-10 6.3 Medium
Azure DevOps Server Spoofing Vulnerability
CVE-2021-40440 1 Microsoft 3 Dynamics 365 Business Central, Dynamics 365 Business Central 2020, Dynamics 365 Business Central 2021 2026-08-10 5.4 Medium
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
CVE-2021-36950 1 Microsoft 1 Dynamics 365 2026-08-10 5.4 Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2021-36946 1 Microsoft 6 Dynamics 365 Business Central, Dynamics 365 Business Central 2019, Dynamics 365 Business Central 2020 and 3 more 2026-08-10 5.4 Medium
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
CVE-2026-72594 1 Lobehub 1 Lobe Chat 2026-08-10 7.6 High
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.
CVE-2026-72576 1 Bludit 1 Bludit 2026-08-10 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.