Search
158,556 CVEs · Medium severity
CVEs (158,556, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 158,556 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-48532 | MEDIUM | Patched | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inj… |
| CVE-2026-48534 | MEDIUM | Patched | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web … |
| CVE-2026-48535 | MEDIUM | Patched | 5.4 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arb… |
| CVE-2026-11804 | MEDIUM | Patched | 5.2 | 2026-07-23 | Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Window… |
| CVE-2026-8287 | MEDIUM | 4.3 | 2026-07-23 | Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive… | |
| CVE-2026-65904 | MEDIUM | 4.7 | 2026-07-23 | DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument… | |
| CVE-2026-65911 | MEDIUM | 6.1 | 2026-07-23 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subseque… | |
| CVE-2026-65912 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers… |
| CVE-2026-65913 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype pr… |
| CVE-2026-65901 | MEDIUM | 6.1 | 2026-07-23 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply… | |
| CVE-2026-65902 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeEleme… |
| CVE-2026-65903 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers ca… |
| CVE-2026-65899 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bou… |
| CVE-2026-65900 | MEDIUM | Patched | 6.1 | 2026-07-23 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to… |
| CVE-2026-16733 | MEDIUM | 5.3 | 2026-07-23 | A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branc… | |
| CVE-2026-16735 | MEDIUM | 5.3 | 2026-07-23 | A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component… | |
| CVE-2026-65550 | MEDIUM | 5.9 | 2026-07-23 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. | |
| CVE-2026-65607 | MEDIUM | 6.5 | 2026-07-23 | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main … | |
| CVE-2026-65531 | MEDIUM | 4.8 | 2026-07-23 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | |
| CVE-2026-65533 | MEDIUM | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. | |
| CVE-2026-65534 | MEDIUM | 5.9 | 2026-07-23 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. | |
| CVE-2026-65535 | MEDIUM | 4.3 | 2026-07-23 | Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions. | |
| CVE-2026-65536 | MEDIUM | 6.5 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions. | |
| CVE-2026-65537 | MEDIUM | 4.3 | 2026-07-23 | Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions. | |
| CVE-2026-65538 | MEDIUM | 5.9 | 2026-07-23 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. |