Feed live

The CMS vulnerability ledger.

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

4 hrs ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-12321	—	—	JIT miscompilation in the JavaScript: WebAssembly component	Jun 16, 2026 11d ago
CVE-2026-12057	high	8.6/10	DoS + Remote Code Execution via PDF JavaScript in Foxit AI	Jun 15, 2026 12d ago
CVE-2026-53606	medium	5.4/10	sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes	Jun 12, 2026 14d ago
CVE-2026-45011	high	7.3/10	Apostrophe has stored XSS via javascript: URL in Image Widget Link	Jun 12, 2026 14d ago
CVE-2026-53722	medium	5.1/10	Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL	Jun 12, 2026 14d ago
CVE-2026-11933	high	8.8/10	Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion	Jun 12, 2026 15d ago
CVE-2026-46625	high	7.5/10	JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection	Jun 10, 2026 16d ago
CVE-2026-53473	high	7.3/10	Migration-planner-ui-app: stored xss via javascript: url in agent credential link	Jun 10, 2026 16d ago
CVE-2026-40993	high	7.3/10	Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry	Jun 9, 2026 17d ago
CVE-2026-41845	high	7.1/10	Spring Framework Cross-site Scripting via JavaScriptUtils	Jun 9, 2026 18d ago
CVE-2026-11618	medium	6.9/10	DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication	Jun 9, 2026 18d ago
CVE-2026-44746	medium	6.1/10	Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet)	Jun 9, 2026 18d ago
CVE-2026-40128	critical	9.0/10	Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)	Jun 9, 2026 18d ago
CVE-2026-45581	medium	5.5/10	fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode	Jun 8, 2026 18d ago
CVE-2026-11521	medium	5.3/10	Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization	Jun 8, 2026 18d ago
CVE-2026-11502	low	2.3/10	JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect	Jun 8, 2026 19d ago
CVE-2026-11477	medium	5.3/10	hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect	Jun 8, 2026 19d ago
CVE-2026-11473	medium	5.3/10	jflyfox jfinal_cms AdvicefeedbackController.java list sql injection	Jun 8, 2026 19d ago
CVE-2026-11470	medium	5.3/10	hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal	Jun 8, 2026 19d ago
CVE-2026-11469	medium	5.1/10	jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery	Jun 7, 2026 19d ago
CVE-2026-11467	medium	5.3/10	jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal	Jun 7, 2026 19d ago
CVE-2026-11464	low	2.3/10	JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure	Jun 7, 2026 19d ago
CVE-2026-46496	critical	9.3/10	HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft	Jun 5, 2026 21d ago
CVE-2026-50076	—	—	Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass	Jun 4, 2026 22d ago
CVE-2026-10771	medium	6.9/10	crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery	Jun 3, 2026 23d ago
CVE-2026-10702	—	—	JIT miscompilation in the JavaScript Engine: JIT component	Jun 2, 2026 24d ago
CVE-2026-33245	high	8.0/10	React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets	Jun 2, 2026 24d ago
CVE-2026-45683	low	3.8/10	OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure	Jun 2, 2026 24d ago
CVE-2026-10567	medium	5.1/10	1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting	Jun 2, 2026 25d ago
CVE-2026-10550	medium	5.3/10	elunez eladmin Application Deployment App.java command injection	Jun 2, 2026 25d ago