boxscore/security
CWE · referenceWeaknesses · latest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CWE-83

Weakness type CWE-83 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.

Totals
CVEs all-timeCVEs YTDKEV all-time
12120

Monthly trend

▃██▆

2026-05 1 · 2026-06 4 · 2026-07 4 · 2026-08 3

Top CVEs

Ranked by KEV → EPSS → CVSS (§6)
CVECVSSEPSS %ileKEVTitle
CVE-2026-451189.331.7MyBB: Contact page reflected XSS
CVE-2026-597272.123.7Astro: Cross-site scripting via unescaped transition:* directive values on hydrated isl…
CVE-2026-457338.323.1Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron d…
CVE-2026-159205.123.1Potential cross-site scripting via URLField values in the admin
CVE-2026-492767.421.5Kirby: Self cross-site scripting (self-XSS) in the writer field
CVE-2026-537225.110.0Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
CVE-2026-538412.18.8OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Sessi…
CVE-2026-623245.47.8Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check…
CVE-2026-582637.27.8Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
CVE-2026-456695.37.5Nuxt: Reflected XSS in `navigateTo()` external redirect
CVE-2026-82456.03.8Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HT…
CVE-2026-485914.83.3Stored XSS via unescaped HTML attribute values in earmark

Most-affected vendors

Vendors with the most CVEs of this type
VendorCVEs
nuxt2
xdan2
concrete cms1
djangoproject1
getkirby1
mybb1
openclaw1
pragdave1
triliumnext1
withastro1