Skip to content
OpenAdvisories

Archive

25 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /25 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-100381 Public exploit

    UploadWizard Flickr collection and set titles allow DOM XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from…

    Wikimedia Foundation Mediawiki - UploadWizard Extension Web / CMS
  • Medium 5.3
    CVE-2026-100380 Public exploit

    Reflected XSS in Wikibase Special:SetLabel language validation

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * befor…

    Wikimedia Foundation Mediawiki - Wikibase Extension Web / CMS
  • Medium 6.9
    CVE-2026-96878 Public exploit

    Cargo Exhibit field alias allows stored XSS

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96877 Public exploit

    Reflected XSS through Cargo Drilldown full-text search

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96876 Public exploit

    Anonymous reflected XSS in CargoExport invalid-alias errors

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-96875 Public exploit

    Reflected XSS in Cargo Drilldown hierarchy filters

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.1
    CVE-2026-88996 Public exploit

    WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

    The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and inc…

    smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Web / CMS
  • Medium 6.5
    CVE-2026-51772 Public exploit

    A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_mult…

    glance Ubuntu