Total
45309 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-46856 | 1 Oracle | 1 Enterprise Manager Base Platform | 2026-06-18 | N/A | 9.6 CRITICAL |
| Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). | |||||
| CVE-2024-3166 | 1 Mintplexlabs | 2 Anythingllm Desktop, Anythingllm Docker | 2026-06-17 | N/A | 9.6 CRITICAL |
| A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application. | |||||
| CVE-2026-54195 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. | |||||
| CVE-2026-54189 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | |||||
| CVE-2026-54188 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | |||||
| CVE-2026-49778 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. | |||||
| CVE-2026-49074 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. | |||||
| CVE-2026-41557 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. | |||||
| CVE-2026-40765 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions. | |||||
| CVE-2026-22339 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WPJobster <= 6.3.5 versions. | |||||
| CVE-2026-22329 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions. | |||||
| CVE-2026-11975 | 2026-06-17 | N/A | N/A | ||
| Stored cross-site scripting (XSS) in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw() | |||||
| CVE-2025-59560 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Sonaar <= 4.27.4 versions. | |||||
| CVE-2024-49269 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions. | |||||
| CVE-2026-48788 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42's own origin. During the download phase, the proxy determines whether the resource is an image by inspecting only the Content-Type header advertised by the remote server, never examining the actual bytes; during the serving phase, it instead derives the response Content-Type by sniffing those bytes with http.DetectContentType. An attacker can exploit this inconsistency by hosting a URL that advertises Content-Type: image/png while returning an HTML/JavaScript body: the download check accepts it as an image, the serving path sniffs the body and emits Content-Type: text/html, and the browser renders the attacker-controlled HTML/JavaScript as a document within Remark42's origin. Exploitation requires no Remark42 account on the target instance; the attacker only needs to host the malicious upstream URL and deliver the proxy link to a victim by any means, such as email, direct message, or a link on another website. This issue has been fixed in version 1.16.0. | |||||
| CVE-2026-12459 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-06-17 | N/A | 6.1 MEDIUM |
| Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-42385 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. | |||||
| CVE-2026-40720 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versions. | |||||
| CVE-2026-39597 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions. | |||||
| CVE-2026-22328 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Auto Repair <= 22.6 versions. | |||||