СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
30| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-40321 DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload dnnsoftware / Dnn.Platform · dnnsoftware / dotnetnuke | Высокий | 8.1 | 6,41 % | 18.04.2026 | ||
| CVE-2026-35534 ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection ChurchCRM / CRM · churchcrm / churchcrm | Критический | 7.6 | 0,17 % | PoC | 07.04.2026 | |
| CVE-2026-42458 Magento LTS: Reflected XSS - Import -> Data Flow (profiles) OpenMage / magento-lts | Высокий | 5.3 | 0,32 % | PoC | 15.05.2026 | |
| CVE-2026-85293 InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms InvoicePlane / InvoicePlane | Высокий | 4.8 | 0,23 % | PoC | 25.09.2026 | |
| CVE-2026-79946 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5 Dell / Secure Connect Gateway 5.0 - Application · Dell / Secure Connect Gateway 5.0 - Appliance | Средний | 5.3 | 0,35 % | 09.09.2026 | ||
| CVE-2025-54369 Node-SAML SAML Authentication Bypass node-saml / node-saml · node-saml | Критический | 9.3 | 0,55 % | 13.12.2025 | ||
| CVE-2026-55661 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes tinacms / tinacms · tinacms / @tinacms/mdx | Средний | 4.8 | 0,41 % | 01.07.2026 | ||
| CVE-2026-45314 Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image open-webui / open-webui · open-webui | Критический | 7.4 | 0,22 % | PoC | 16.05.2026 | |
| CVE-2026-54002 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` getkirby / kirby | Высокий | 8.5 | 0,55 % | 09.07.2026 | ||
| CVE-2026-55237 AutoGPT SignUp Page has DOM-Based XSS and Open Redirect Significant-Gravitas / AutoGPT | Критический | 8.8 | 0,23 % | PoC | 18.06.2026 | |
| CVE-2026-46492 md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) commenthol / md-fileserver · md-fileserver | Критический | 7.2 | 0,23 % | PoC | 09.06.2026 | |
| CVE-2026-25688 Apache Answer: XSS in AI Answer Rendering Apache Software Foundation / Apache Answer | Средний | 6.1 | 0,41 % | 09.06.2026 | ||
| CVE-2026-42235 n8n: XSS via MCP OAuth client n8n-io / n8n · n8n | Высокий | 8.8 | 0,33 % | 04.05.2026 | ||
| CVE-2026-22711 Stored XSS through system messages in WikiLove The Wikimedia Foundation / Mediawiki - Wikilove Extension | Средний | 6.9 | 0,29 % | 07.04.2026 | ||
| CVE-2025-8561 Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ovatheme / Ova Advent | Средний | 6.4 | 0,23 % | 15.10.2025 | ||
| CVE-2024-3162 Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial jegtheme / Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | Средний | 6.4 | 0,32 % | 03.04.2024 | ||
| CVE-2024-4459 Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles themesflat / Themesflat Addons For Elementor | Средний | 6.4 | 0,34 % | 06.06.2024 | ||
| CVE-2024-8505 WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter dcooney / Ajax Load More – Infinite Scroll, Load More, & Lazy Load · connekthq / ajax_load_more | Средний | 6.4 | 0,39 % | 02.10.2024 | ||
| CVE-2024-3666 Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting wpopal / Opal Estate Pro – Property Management and Submission · wpopal / opal_estate_pro | Средний | 6.4 | 0,26 % | 22.05.2024 | ||
| CVE-2024-2618 Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting brainstormforce / Ultimate Addons for Elementor | Средний | 6.4 | 0,32 % | 24.05.2024 | ||
| CVE-2024-3519 Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang dglingren / Media Library Assistant | Средний | 6.1 | 0,33 % | 22.05.2024 | ||
| CVE-2024-2657 Font Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting khl32 / Font Farsi | Средний | 4.4 | 0,26 % | 30.05.2024 | ||
| CVE-2024-2750 Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget timstrifler / Exclusive Addons for Elementor | Средний | 6.4 | 0,32 % | 02.05.2024 | ||
| CVE-2025-14732 Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API elemntor / Elementor Website Builder – more than just a page builder | Средний | 6.4 | 0,34 % | 08.04.2026 | ||
| CVE-2026-33510 DOM-Based XSS in Homarr /auth/login Redirect homarr-labs / homarr | Критический | 8.8 | 0,24 % | PoC | 06.04.2026 | |
| CVE-2026-34598 YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" YesWiki / yeswiki | Высокий | 7.1 | 0,22 % | 02.04.2026 | ||
| CVE-2026-33506 DOM-Based XSS in Ory Polis Login Page ory / polis | Высокий | 8.8 | 0,47 % | 26.03.2026 | ||
| CVE-2025-52563 Chamilo: Reflected XSS via page parameter chamilo / chamilo-lms | Средний | 5.1 | 0,18 % | 02.03.2026 | ||
| CVE-2026-27120 Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster vapor / leaf-kit | Средний | 6.1 | 0,27 % | 21.02.2026 | ||
| CVE-2025-65961 Contao is vulnerable to cross-site scripting in templates contao / contao | Низкий | 3.3 | 0,18 % | 25.11.2025 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.