Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.2OmniFaces is a utility library for Faces.Jul 24, 2026
- Medium5.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection.May 28, 2026
- Medium5.4TinyMCE is an open source rich text editor.May 28, 2026
- Medium5.4TinyMCE is an open source rich text editor.May 28, 2026
- Medium5.4TinyMCE is an open source rich text editor.May 28, 2026
- Medium5.4TinyMCE is an open source rich text editor.May 28, 2026
- Medium5.5Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers a…May 27, 2026
- High8.2IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS).May 27, 2026
- Critical9.1Same-origin policy bypass in the DOM: Networking component.May 19, 2026
- Medium5.1A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter.May 19, 2026
- Medium4.8A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter.May 19, 2026
- Medium4.8A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter.May 19, 2026
- Medium4.8A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter.May 19, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.May 19, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), I…May 19, 2026
- Medium6.1Microsoft Edge (Chromium-based) Spoofing VulnerabilityMay 18, 2026
- Medium4.8Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows…May 18, 2026
- Medium6.1Microsoft Exchange Server Cross-Site Scripting VulnerabilityKEVEPSS 0.5%May 14, 2026
- Medium5.1HTML injection vulnerability in PHP Point of Sale v19.4.Apr 21, 2026
- Medium5.1Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki.Apr 21, 2026
- Medium6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.Apr 16, 2026
- High7.1A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter.Apr 15, 2026
- Medium5.4An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0…Apr 14, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue affects P…Jan 8, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliat…Jan 6, 2026