Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-83
Weakness type CWE-83 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 15 | 15 | 0 |
Monthly trend
▃██▆▃▅
2026-05 1 · 2026-06 4 · 2026-07 4 · 2026-08 3 · 2026-09 1 · 2026-10 2
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-45118 | 9.3 | 44.6 | — | MyBB: Contact page reflected XSS |
| CVE-2026-59727 | 2.1 | 44.1 | — | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated isl… |
| CVE-2026-45733 | 8.3 | 36.1 | — | Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron d… |
| CVE-2026-49276 | 7.4 | 36.1 | — | Kirby: Self cross-site scripting (self-XSS) in the writer field |
| CVE-2026-91127 | 8.2 | 32.3 | — | File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer |
| CVE-2026-15920 | 5.1 | 27.6 | — | Potential cross-site scripting via URLField values in the admin |
| CVE-2026-53722 | 5.1 | 24.2 | — | Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL |
| CVE-2026-62324 | 5.4 | 22.7 | — | Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check… |
| CVE-2026-58263 | 7.2 | 21.2 | — | Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier |
| CVE-2026-45669 | 5.3 | 19.1 | — | Nuxt: Reflected XSS in `navigateTo()` external redirect |
| CVE-2026-53841 | 2.1 | 17.3 | — | OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Sessi… |
| CVE-2026-8245 | 6.0 | 13.6 | — | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HT… |
| CVE-2026-58391 | 5.4 | 11.1 | — | OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout |
| CVE-2026-108260 | 7.6 | 9.8 | — | @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without… |
| CVE-2026-48591 | 4.8 | 7.8 | — | Stored XSS via unescaped HTML attribute values in earmark |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| nuxt | 2 |
| xdan | 2 |
| @file-viewer | 1 |
| @tinacms | 1 |
| concrete cms | 1 |
| djangoproject | 1 |
| flyfish-dev | 1 |
| getkirby | 1 |
| mybb | 1 |
| openclaw | 1 |
| opnsense | 1 |
| pragdave | 1 |
| tinacms | 1 |
| triliumnext | 1 |
| withastro | 1 |
