Catalog

Findings

Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.

SearchRecord typeSeveritySourceStackWeaknessSort

Known exploited only

Reset

Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary JavaScrip…Vuln · CVE-2026-48214 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary JavaScript b…Vuln · CVE-2026-48213 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 21, 2026
High8.4Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authe…Vuln · CVE-2026-9144 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.5%May 20, 2026
Medium5.3Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to l…Vuln · CVE-2026-9124 · google · chrome · CVE.org · FIRST EPSS · NIST NVD · Chrome, GoogleEPSS 0.3%May 20, 2026
High7.5Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially per…Vuln · CVE-2026-9117 · google · chrome · CVE.org · FIRST EPSS · NIST NVD · Chrome, GoogleEPSS 0.3%May 20, 2026
Medium4.2Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI…Vuln · CVE-2026-9110 · google · chrome · CVE.org · FIRST EPSS · NIST NVD · Chrome, GoogleEPSS 0.2%May 20, 2026
High7.4Yii 2 is a PHP application framework.Vuln · CVE-2026-39850 · CVE.org · FIRST EPSS · NIST NVD · PHPEPSS 0.5%May 20, 2026
Medium6.1CryptPad is an end-to-end encrypted collaborative office suite.Vuln · CVE-2026-26028 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 20, 2026
Medium6.1Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file.Vuln · CVE-2026-30691 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 20, 2026
Critical9.5Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx temp…Vuln · CVE-2026-8467 · CVE.org · FIRST EPSS · NIST NVDEPSS 2.1%May 20, 2026
High8.7Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering c…Vuln · CVE-2026-24425 · symfony · twig · CVE.org · FIRST EPSS · NIST NVDEPSS 0.8%May 20, 2026
Medium4.3The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in…Vuln · CVE-2026-6405 · CVE.org · FIRST EPSS · NIST NVD · WordPressEPSS 0.2%May 20, 2026
High7.4mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager.Vuln · CVE-2026-7460 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.4%May 20, 2026
Medium4.4The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0.Vuln · CVE-2026-6399 · CVE.org · FIRST EPSS · NIST NVD · WordPressEPSS 0.3%May 20, 2026
Medium6.1The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2.Vuln · CVE-2026-6395 · CVE.org · FIRST EPSS · NIST NVD · WordPressEPSS 0.2%May 20, 2026
Medium4.8CtrlPanel is open-source billing software for hosting providers.Vuln · CVE-2026-34246 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 19, 2026
High8.7CtrlPanel is open-source billing software for hosting providers.Vuln · CVE-2026-34241 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.4%May 19, 2026
Medium6.5Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the re…Vuln · CVE-2026-8706 · mozilla · firefox · CVE.org · FIRST EPSS · NIST NVD · FirefoxEPSS 0.2%May 19, 2026
Critical9.6A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler.Vuln · CVE-2026-2587 · eclipse · glassfish · CVE.org · FIRST EPSS · NIST NVDEPSS 0.7%May 19, 2026
Medium5.1A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter.Vuln · CVE-2025-40904 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026
Medium4.8A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter.Vuln · CVE-2025-40903 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026
Medium4.8A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter.Vuln · CVE-2025-40902 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026
Medium4.8A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter.Vuln · CVE-2025-40901 · nozominetworks · cmc · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 19, 2026
High7.5AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents.Vuln · CVE-2026-33232 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.5%May 19, 2026
Low3.9FacturaScripts is an open source accounting and invoicing software.Vuln · CVE-2026-27964 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.1%May 18, 2026