CWE-83

35 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 4High 11Medium 16Low 4Not scored 0

CVEs per yearBy the year they were published

CVE-2026-112356
GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
GFI USA, LLC · GFI KerioConnect
Medium5.1
CVE-2026-112353
GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment
GFI USA, LLC · GFI KerioConnect
Medium6.2
CVE-2026-61791
OCO-Server: Stored XSS through agent hostnames in command buttons
schorschii · OCO-Server
High7.4
CVE-2026-58391
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
opnsense · core
Medium5.4
CVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
tinacms · tinacms
High7.6
CVE-2026-91127
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
flyfish-dev · file-viewer
High8.2
CVE-2026-45118
MyBB: Contact page reflected XSS
mybb · mybb
Critical9.3
CVE-2026-45733
Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
TriliumNext · Trilium
High8.3
CVE-2026-15920
Potential cross-site scripting via URLField values in the admin
djangoproject · Django
Medium5.1
CVE-2026-62324
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
xdan · jodit
Medium5.4