СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
30| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-112356 GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter GFI USA, LLC / GFI KerioConnect | Средний | 5.1 | 0,25 % | Патч | 28.10.2026 | |
| CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons schorschii / OCO-Server | Высокий | 7.4 | 0,29 % | 22.10.2026 | ||
| CVE-2023-32070 XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check f xwiki / rendering · xwiki / xwiki | Средний | 6.1 | 0,65 % | Патч | 10.05.2023 | |
| CVE-2026-112353 GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment GFI USA, LLC / GFI KerioConnect | Средний | 6.2 | 0,24 % | Патч | 27.10.2026 | |
| CVE-2026-58391 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout opnsense / core | Высокий | 5.4 | 0,27 % | PoC | 15.10.2026 | |
| CVE-2026-108260 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS tinacms / tinacms · @tinacms / web-components | Критический | 7.6 | 0,25 % | PoC | 09.10.2026 | |
| CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer flyfish-dev / file-viewer · @file-viewer / doc | Высокий | 8.2 | 0,4 % | 18.09.2026 | ||
| CVE-2025-27145 copyparty renders unsanitized filenames as HTML when user uploads empty files 9001 / copyparty · copyparty | Средний | 3.6 | 0,47 % | PoC | 25.02.2025 | |
| CVE-2026-45118 MyBB: Contact page reflected XSS mybb / mybb | Критический | 9.3 | 0,55 % | 18.08.2026 | ||
| CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app TriliumNext / Trilium | Критический | 8.3 | 0,43 % | PoC | 18.08.2026 | |
| CVE-2026-53722 Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL nuxt / nuxt · nuxt | Средний | 5.1 | 0,29 % | 12.06.2026 | ||
| CVE-2026-59727 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands withastro / astro · astro | Средний | 2.1 | 0,39 % | PoC | 27.07.2026 | |
| CVE-2026-15920 Potential cross-site scripting via URLField values in the admin djangoproject / Django | Средний | 5.1 | 0,35 % | Патч | 04.08.2026 | |
| CVE-2026-62324 Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS xdan / jodit · jodit | Высокий | 5.4 | 0,31 % | PoC | 31.07.2026 | |
| CVE-2026-58263 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier xdan / jodit · jodit | Критический | 7.2 | 0,22 % | PoC | 01.07.2026 | |
| CVE-2026-49276 Kirby: Self cross-site scripting (self-XSS) in the writer field getkirby / kirby | Высокий | 7.4 | 0,43 % | 09.07.2026 | ||
| CVE-2026-45669 Nuxt: Reflected XSS in `navigateTo()` external redirect nuxt / nuxt · nuxt | Высокий | 5.3 | 0,18 % | PoC | 12.06.2026 | |
| CVE-2026-53841 OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML OpenClaw / OpenClaw · openclaw | Низкий | 2.1 | 0,19 % | 16.06.2026 | ||
| CVE-2026-48591 Stored XSS via unescaped HTML attribute values in earmark pragdave / earmark | Средний | 4.8 | 0,13 % | 17.06.2026 | ||
| CVE-2026-8245 Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection Concrete CMS / Concrete CMS | Средний | 6.0 | 0,14 % | 22.05.2026 | ||
| CVE-2025-4615 PAN-OS: Improper Neutralization of Input in the Management Web Interface Palo Alto Networks / Cloud NGFW · Palo Alto Networks / PAN-OS | Средний | 5.5 | 0,78 % | 09.10.2025 | ||
| CVE-2026-23516 CVAT vulnerable to XSS via skeleton SVG images cvat-ai / cvat | Высокий | 8.6 | 0,17 % | 22.01.2026 | ||
| CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields saleor / saleor | Высокий | 7.2 | 0,25 % | 22.01.2026 | ||
| CVE-2025-67163 A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers t n/a / n/a | Средний | 6.1 | 0,25 % | 18.12.2025 | ||
| CVE-2025-11682 Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform Perx Technologies / Customer Engagement & Loyalty Platform | Высокий | 7.1 | 0,19 % | 27.10.2025 | ||
| CVE-2025-58746 Volkov Labs Business Links plugin vulnerable to privilege escalation attack VolkovLabs / business-links | Критический | 9.1 | 0,31 % | PoC | 09.09.2025 | |
| CVE-2025-0137 PAN-OS: Improper Neutralization of Input in the Management Web Interface Palo Alto Networks / Cloud NGFW · Palo Alto Networks / PAN-OS | Средний | 4.8 | 0,42 % | 14.05.2025 | ||
| CVE-2025-0125 PAN-OS: Improper Neutralization of Input in the Management Web Interface Palo Alto Networks / Cloud NGFW · Palo Alto Networks / PAN-OS | Средний | 6.9 | 0,42 % | 11.04.2025 | ||
| CVE-2024-9103 Persistent XSS in blocked messages Forcepoint / Email Security | Средний | 6.1 | 0,23 % | 24.03.2025 | ||
| CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through fedora-python / lxml_html_clean · lxml-html-clean | Высокий | 7.7 | 0,51 % | Патч | 20.11.2024 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.