CWE-79: Cross-site scripting (XSS)
49,353 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 32 of them as exploited in the wild.
- Published CVEs
- 49,353
- Last 12 months
- 9,291
- Critical
- 716
- Known exploited
- 32
Critical 716High 6,273Medium 39,874Low 2,442Not scored 48
CVEs per yearBy the year they were published
- 2015726
- 2016472
- 20171,477
- 20182,021
- 20192,342
- 20202,169
- 20212,686
- 20223,230
- 20234,733
- 20247,368
- 20258,293
- 20268,185
Known exploitedNewest addition to KEV first
- CVE-2026-42897
Microsoft Exchange Server Spoofing Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23
ExploitedHigh8.1 - CVE-2025-48700
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI…
Product not named
ExploitedMedium6.1 - CVE-2025-66376
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an…
Zimbra · Collaboration
ExploitedHigh7.2 - CVE-2025-68461
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
Roundcube · Webmail
ExploitedHigh7.2 - CVE-2021-26829
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Product not named
ExploitedMedium5.4 - CVE-2025-27915
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client…
Product not named
ExploitedMedium5.4 - CVE-2024-42009
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a…
Product not named
ExploitedCritical9.3 - CVE-2024-11182
Stored XSS vulnerability in MDaemon Email Server
MDaemon · Email Server
ExploitedMedium5.3 - CVE-2024-27443
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the…
Product not named
ExploitedMedium6.1 - CVE-2023-34192
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the…
Product not named
ExploitedCritical9.0
Newest CVEs
- CVE-2026-124552
Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgi
webmin · webmin
Medium4.8 - CVE-2026-124474
MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php
meeting-room-booking-system · mrbs-code
Medium5.3 - CVE-2026-124494
SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
JiHong88 · suneditor
Critical9.3 - CVE-2026-124493
SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent
JiHong88 · suneditor
Critical9.3 - CVE-2026-124492
SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List
JiHong88 · suneditor
High8.3 - CVE-2026-124491
SunEditor before 3.4.0 Stored XSS via FileUpload Plugin Filename
JiHong88 · suneditor
Medium5.3 - CVE-2026-124463
OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View
openemr · openemr
Critical9.3 - CVE-2026-124452
OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
openemr · openemr
Medium5.1 - CVE-2026-124448
OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes
openemr · openemr
High8.6 - CVE-2026-124435
OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload
openremote · core
Medium4.6