CWE-83
35 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 35Published CVEs35 of them scored
- 21Last 12 monthspublished in the last year
- 4Critical11 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-112356
GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
GFI USA, LLC · GFI KerioConnect
Medium5.1 - CVE-2026-112353
GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment
GFI USA, LLC · GFI KerioConnect
Medium6.2 - CVE-2026-61791
OCO-Server: Stored XSS through agent hostnames in command buttons
schorschii · OCO-Server
High7.4 - CVE-2026-58391
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
opnsense · core
Medium5.4 - CVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
tinacms · tinacms
High7.6 - CVE-2026-91127
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
flyfish-dev · file-viewer
High8.2 - CVE-2026-45118
MyBB: Contact page reflected XSS
mybb · mybb
Critical9.3 - CVE-2026-45733
Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
TriliumNext · Trilium
High8.3 - CVE-2026-15920
Potential cross-site scripting via URLField values in the admin
djangoproject · Django
Medium5.1 - CVE-2026-62324
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
xdan · jodit
Medium5.4