CVEs from 2026
Total
14,786
critical
critical 1,335
high
high 5,004
medium
medium 4,828
low
low 503
% Critical
9.0%
% with KEV
0.4%
% with exploit
0.7%
Top vendors
Top products
- chrome 723
- firepower_threat_defense_software 310
- gcp 299
- firepower_threat_defense 298
- openclaw 172
- commerce 104
- netweaver_application_server_abap 102
- commerce_b2b 89
Top packages
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-0055 | medium | 6.2 | 6.2 | 5d ago | In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a path traversal error. This could lead to lo… | |||
| CVE-2026-0046 | medium | 6.2 | 6.2 | 5d ago | In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no… | |||
| CVE-2026-8594 | medium | 6.2 | 6.2 | 7d ago | Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such… | |||
| CVE-2026-42328 | medium | 6.2 | 6.2 | 10d ago | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on … | |||
| CVE-2026-23679 | medium | 6.2 | 6.2 | 10d ago | libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface cla… | |||
| CVE-2026-2237 | medium | 6.2 | 6.2 | 10d ago | A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive inf… | |||
| CVE-2026-48696 | medium | 6.2 | 6.2 | 12d ago | FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE-2026-48689. | |||
| CVE-2026-42627 | medium | 6.2 | 6.2 | 15d ago | In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based … | |||
| CVE-2026-36189 | medium | 6.2 | 6.2 | 16d ago | Buffer Overflow vulnerability in Uncrustify Project Affected v.Uncrustify_d-0.82.0-132-bcc41cbdc and Fixed in commit 68e67b9a1435a1bb173b106fedb4a4f510972bdc allows a local attacker to cause a denial… | |||
| CVE-2026-38719 | medium | 6.2 | 6.2 | 19d ago | OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommonPacketFormatStructure() in source/src/enet_encap/cpf.c. A c… | |||
| CVE-2026-41969 | medium | 6.2 | 6.2 | 22d ago | Permission control vulnerability in the projection module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||
| CVE-2026-34688 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit … | |||
| CVE-2026-34680 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exp… | |||
| CVE-2026-34679 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit … | |||
| CVE-2026-34678 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could explo… | |||
| CVE-2026-34677 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could explo… | |||
| CVE-2026-34673 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could explo… | |||
| CVE-2026-34672 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker c… | |||
| CVE-2026-34671 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exp… | |||
| CVE-2026-34670 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit … | |||
| CVE-2026-34669 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit … | |||
| CVE-2026-34668 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit … | |||
| CVE-2026-34667 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker c… | |||
| CVE-2026-34666 | medium | 6.2 | 6.2 | 25d ago | CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit … | |||
| CVE-2026-42045 | medium | 6.2 | 6.2 | 25d ago | LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution | |||
| CVE-2026-41614 | medium | 6.2 | 6.2 | 25d ago | Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally. | |||
| CVE-2026-40380 | medium | 6.2 | 6.2 | 25d ago | Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. | |||
| CVE-2026-28950 | medium | 6.2 | 6.2 | 27d ago | iOS 18.7.8 and iPadOS 18.7.8 | |||
| CVE-2026-28897 | medium | 6.2 | 6.2 | 27d ago | visionOS 26.5 | |||
| CVE-2026-43666 | medium | 6.2 | 6.2 | 27d ago | visionOS 26.5 | |||
| CVE-2026-43653 | medium | 6.2 | 6.2 | 27d ago | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5. An attacker on … | |||
| CVE-2026-28985 | medium | 6.2 | 6.2 | 27d ago | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to … | |||
| CVE-2026-28977 | medium | 6.2 | 6.2 | 27d ago | visionOS 26.5 | |||
| CVE-2026-42199 | medium | 6.2 | 6.2 | 29d ago | Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior | |||
| CVE-2026-35902 | medium | 6.2 | 6.2 | 1mo ago | The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication paramete… | |||
| CVE-2026-6386 | medium | 6.2 | 6.2 | 2mo ago | In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled this failed to take into account the pres… | |||
| CVE-2026-32072 | medium | 6.2 | 6.2 | 2mo ago | Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. | |||
| CVE-2026-28833 | medium | 6.2 | 6.2 | 2mo ago | visionOS 26.4 | |||
| CVE-2026-9280 | medium | 6.1 | 6.1 | 16h ago | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to i… | |||
| CVE-2026-50235 | medium | 6.1 | 6.1 | 1d ago | Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attacke… | |||
| CVE-2026-50230 | medium | 6.1 | 6.1 | 1d ago | Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject arbitrary HTML and JavaScript code throug… | |||
| CVE-2026-21826 | medium | 6.1 | 6.1 | 2d ago | HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected … | |||
| CVE-2026-21825 | medium | 6.1 | 6.1 | 2d ago | HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary JavaScript in the victim's browser. | |||
| CVE-2026-11273 | medium | 6.1 | 6.1 | 2d ago | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scri… | |||
| CVE-2026-11229 | medium | 6.1 | 6.1 | 2d ago | Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security sever… | |||
| CVE-2026-11205 | medium | 6.1 | 6.1 | 2d ago | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject … | |||
| CVE-2026-11186 | medium | 6.1 | 6.1 | 2d ago | Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: … | |||
| CVE-2026-11150 | medium | 6.1 | 6.1 | 2d ago | Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: … | |||
| CVE-2026-11034 | medium | 6.1 | 6.1 | 2d ago | Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious netw… | |||
| CVE-2026-10916 | medium | 6.1 | 6.1 | 2d ago | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (… | |||
| CVE-2026-8916 | medium | 6.1 | 6.1 | 2d ago | Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635. | |||
| CVE-2026-49510 | medium | 6.1 | 6.1 | 2d ago | Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f. | |||
| CVE-2026-47320 | medium | 6.1 | 6.1 | 2d ago | Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads. This issue affects rlottie: befo… | |||
| CVE-2026-47319 | medium | 6.1 | 6.1 | 2d ago | Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. This issue affects rlottie: before 0b4e308fa88c72cbb60cc8a2c1d2c2ad89b101dd. | |||
| CVE-2026-47318 | medium | 6.1 | 6.1 | 2d ago | Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035. | |||
| CVE-2026-47306 | medium | 6.1 | 6.1 | 2d ago | Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945. | |||
| CVE-2026-10305 | medium | 6.1 | 6.1 | 2d ago | Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: before 223a2a41ba4f462e4abe767bebba49a366c9b9fd. | |||
| CVE-2026-6657 | medium | 6.1 | 6.1 | 3d ago | A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use o… | |||
| CVE-2026-20175 | medium | 6.1 | 6.1 | 3d ago | A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an affected device, possibly leading to b… | |||
| CVE-2026-20233 | medium | 6.1 | 6.1 | 3d ago | A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this… | |||
| CVE-2026-35212 | medium | 6.1 | 6.1 | 4d ago | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable bo… | |||
| CVE-2026-41569 | medium | 6.1 | 6.1 | 4d ago | authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper UR… | |||
| CVE-2026-40181 | medium | 6.1 | 6.1 | 4d ago | React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to p… | |||
| CVE-2026-33553 | medium | 6.1 | 6.1 | 4d ago | Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS. | |||
| CVE-2026-30586 | medium | 6.1 | 6.1 | 4d ago | Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information via the SANITIZE_SCHEMA, Memo Rendering Component, and Public/Private Memo View … | |||
| CVE-2026-40713 | medium | 6.1 | 6.1 | 4d ago | Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access control vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerabilit… | |||
| CVE-2026-2425 | medium | 6.1 | 6.1 | 4d ago | The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input … | |||
| CVE-2026-1451 | medium | 6.1 | 6.1 | 4d ago | The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escapi… | |||
| CVE-2026-1450 | medium | 6.1 | 6.1 | 4d ago | The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output esc… | |||
| CVE-2026-10510 | medium | 6.1 | 6.1 | 5d ago | Cross-Site Scripting (XSS) in GeniexWebView component in Transsion AI Assistant Lifestyle application (com.transsion.aiassistantlifestyle) all versions on Android allows remote attacker to execute ar… | |||
| CVE-2026-45278 | medium | 6.1 | 6.1 | 5d ago | Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses … | |||
| CVE-2026-42253 | medium | 6.1 | 6.1 | 5d ago | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies … | |||
| CVE-2026-5071 | medium | 6.1 | 6.1 | 8d ago | The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socke… | |||
| CVE-2026-49384 | medium | 6.1 | 6.1 | 8d ago | In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible | |||
| CVE-2026-49380 | medium | 6.1 | 6.1 | 8d ago | In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible | |||
| CVE-2026-49375 | medium | 6.1 | 6.1 | 8d ago | In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page | |||
| CVE-2026-36324 | medium | 6.1 | 6.1 | 8d ago | SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in the user registration functionality in register.php. | |||
| CVE-2026-9646 | medium | 6.1 | 6.1 | 9d ago | A reflected cross-site scripting issue exists in URL handling. | |||
| CVE-2026-47328 | medium | 6.1 | 6.1 | 9d ago | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the same time leaking allocated memory. The bug… | |||
| CVE-2026-45307 | medium | 6.1 | 6.1 | 9d ago | Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied urlj… | |||
| CVE-2026-7660 | medium | 6.1 | 6.1 | 10d ago | The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sani… | |||
| CVE-2026-44681 | medium | 6.1 | 6.1 | 10d ago | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authoriza… | |||
| CVE-2026-44475 | medium | 6.1 | 6.1 | 10d ago | Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored va… | |||
| CVE-2026-49102 | medium | 6.1 | 6.1 | 10d ago | Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain). | |||
| CVE-2026-47119 | medium | 6.1 | 6.1 | 10d ago | Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript in the application origin by serving SVG files through the im… | |||
| CVE-2026-3349 | medium | 6.1 | 6.1 | 10d ago | The MinhNhut Link Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter on the redirect page in all versions up to, and including, 3.6.1 due to insuffic… | |||
| CVE-2026-8906 | medium | 6.1 | 6.1 | 11d ago | The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on a function. This ma… | |||
| CVE-2026-3001 | medium | 6.1 | 6.1 | 11d ago | The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output… | |||
| CVE-2026-8707 | medium | 6.1 | 6.1 | 11d ago | The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to insufficient input sanitization and outp… | |||
| CVE-2026-8911 | medium | 6.1 | 6.1 | 11d ago | The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on a function. This … | |||
| CVE-2026-44903 | medium | 6.1 | 6.1 | 11d ago | Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-f… | |||
| CVE-2026-44897 | medium | 6.1 | 6.1 | 11d ago | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value directly into the HTM… | |||
| CVE-2026-44708 | medium | 6.1 | 6.1 | 11d ago | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied con… | |||
| CVE-2026-44899 | medium | 6.1 | 6.1 | 11d ago | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^… | |||
| CVE-2026-44896 | medium | 6.1 | 6.1 | 11d ago | Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and realier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options direc… | |||
| CVE-2026-30894 | medium | 6.1 | 6.1 | 11d ago | Lack of output escaping leads to a XSS vector in the content history component. | |||
| CVE-2026-48903 | medium | 6.1 | 6.1 | 11d ago | Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components. | |||
| CVE-2026-48905 | medium | 6.1 | 6.1 | 11d ago | Lack of input filtering leads to an XSS vector in the HTML filter code. | |||
| CVE-2026-25901 | medium | 6.1 | 6.1 | 11d ago | Lack of output escaping leads to a XSS vector in the multilingual associations component. | |||
| CVE-2026-25900 | medium | 6.1 | 6.1 | 11d ago | Lack of output escaping leads to a XSS vector in the feed modules. |