Total
47257 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-29964 | 1 Hsclabs | 1 Mailinspector | 2026-06-17 | N/A | 6.1 MEDIUM |
| HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output encoding, allowing a remote attacker to execute arbitrary JavaScript code in the context of a victim's browser. | |||||
| CVE-2026-29934 | 1 Lightcms Project | 1 Lightcms | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referer value in the request header. | |||||
| CVE-2026-29933 | 1 Yzmcms | 1 Yzmcms | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer value in the request header. | |||||
| CVE-2026-29859 | 1 Aapanel | 1 Aapanel | 2026-06-17 | N/A | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file. | |||||
| CVE-2026-29840 | 1 Jizhicms | 1 Jizhicms | 2026-06-17 | N/A | 5.4 MEDIUM |
| JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering <script> tags but fails to recursively remove dangerous event handlers in other HTML tags (such as onerror in <img> tags). This allows an authenticated remote attacker to inject arbitrary web script or HTML via the body parameter in a POST request to /user/release.html. | |||||
| CVE-2026-29828 | 1 Dootask | 1 Dootask | 2026-06-17 | N/A | 6.1 MEDIUM |
| DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc. | |||||
| CVE-2026-29520 | 1 Hereta | 2 Eth-imc408m, Eth-imc408m Firmware | 2026-06-17 | N/A | 6.1 MEDIUM |
| Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript. Attackers can craft malicious links with injected script payloads in the ping_ipaddr parameter to compromise authenticated administrator sessions when the links are visited. | |||||
| CVE-2026-29513 | 1 Hereta | 2 Eth-imc408m, Eth-imc408m Firmware | 2026-06-17 | N/A | 5.4 MEDIUM |
| Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation. | |||||
| CVE-2026-29510 | 1 Hereta | 2 Eth-imc408m, Eth-imc408m Firmware | 2026-06-17 | N/A | 5.4 MEDIUM |
| Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation. | |||||
| CVE-2026-29192 | 1 Zitadel | 1 Zitadel | 2026-06-17 | N/A | 7.7 HIGH |
| ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0. | |||||
| CVE-2026-29191 | 1 Zitadel | 1 Zitadel | 2026-06-17 | N/A | 9.3 CRITICAL |
| ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0. | |||||
| CVE-2026-29183 | 1 B3log | 1 Siyuan | 2026-06-17 | N/A | 9.3 CRITICAL |
| SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoint is unauthenticated and returns image/svg+xml, a crafted URL can inject executable SVG/HTML event handlers (for example onerror) and run JavaScript in the SiYuan web origin. This can be chained to perform authenticated API actions and exfiltrate sensitive data when a logged-in user opens the malicious link. This issue has been patched in version 3.5.9. | |||||
| CVE-2026-29177 | 1 Craftcms | 1 Craft Commerce | 2026-06-17 | N/A | 5.4 MEDIUM |
| Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3. | |||||
| CVE-2026-29176 | 1 Craftcms | 1 Craft Commerce | 2026-06-17 | N/A | 4.8 MEDIUM |
| Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnerability is fixed in 5.5.3. | |||||
| CVE-2026-29175 | 1 Craftcms | 1 Craft Commerce | 2026-06-17 | N/A | 5.4 MEDIUM |
| Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3. | |||||
| CVE-2026-29173 | 1 Craftcms | 1 Craft Commerce | 2026-06-17 | N/A | 4.8 MEDIUM |
| Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3. | |||||
| CVE-2026-29136 | 1 Seppmail | 1 Secure Email Gateway | 2026-06-17 | N/A | 6.1 MEDIUM |
| SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to inject HTML into notification emails about new CA certificates. | |||||
| CVE-2026-29106 | 1 Suitecrm | 1 Suitecrm | 2026-06-17 | N/A | 5.9 MEDIUM |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the return_id request parameter is copied into the value of an HTML tag attribute which is an event handler and is encapsulated in double quotation marks. Versions 7.15.1 and 8.9.3 patch the issue. Users should also use a Content Security Policy (CSP) header to completely mitigate XSS. | |||||
| CVE-2026-29100 | 1 Suitecrm | 1 Suitecrm | 2026-06-17 | N/A | 7.1 HIGH |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches the issue. | |||||
| CVE-2026-29082 | 1 Kestra | 1 Kestra | 2026-06-17 | N/A | 7.3 HIGH |
| Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches. | |||||