Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-83
Weakness type CWE-83 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 13 | 13 | 0 |
Monthly trend
▃██▆▃▁
2026-05 1 · 2026-06 4 · 2026-07 4 · 2026-08 3 · 2026-09 1 · 2026-10 0
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-45118 | 9.3 | 44.0 | — | MyBB: Contact page reflected XSS |
| CVE-2026-59727 | 2.1 | 43.4 | — | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated isl… |
| CVE-2026-45733 | 8.3 | 35.5 | — | Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron d… |
| CVE-2026-49276 | 7.4 | 35.4 | — | Kirby: Self cross-site scripting (self-XSS) in the writer field |
| CVE-2026-91127 | 8.2 | 31.6 | — | File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer |
| CVE-2026-15920 | 5.1 | 27.0 | — | Potential cross-site scripting via URLField values in the admin |
| CVE-2026-53722 | 5.1 | 23.6 | — | Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL |
| CVE-2026-62324 | 5.4 | 22.1 | — | Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check… |
| CVE-2026-58263 | 7.2 | 20.7 | — | Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier |
| CVE-2026-45669 | 5.3 | 18.6 | — | Nuxt: Reflected XSS in `navigateTo()` external redirect |
| CVE-2026-53841 | 2.1 | 16.9 | — | OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Sessi… |
| CVE-2026-8245 | 6.0 | 13.3 | — | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HT… |
| CVE-2026-48591 | 4.8 | 7.6 | — | Stored XSS via unescaped HTML attribute values in earmark |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| nuxt | 2 |
| xdan | 2 |
| @file-viewer | 1 |
| concrete cms | 1 |
| djangoproject | 1 |
| flyfish-dev | 1 |
| getkirby | 1 |
| mybb | 1 |
| openclaw | 1 |
| pragdave | 1 |
| triliumnext | 1 |
| withastro | 1 |
