CWE-84

CVEs classified under CWE-84, newest first.

4 CVEsRSS

CVE-2026-96654Medium· 6.5CISA KEVPoC

1mo ago

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

▾ Midnightplex · media_serverEPSS 1.9%via NVD

CVE-2026-88859Medium· 6.3

1mo ago

A flaw was found in Evolution

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler in…

▾ SunlitRed Hat · evolutionEPSS 0.53%via NVD

CVE-2026-67338Medium· 6.1

2mo ago

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in p…

▾ Sunlitjupyterlab · jupyterlabEPSS 0.30%via NVD

GHSA-vmhf-c436-hxj4Medium

4mo ago

JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol

▾ Sunlitjupyterlab · jupyterlabvia GHSA