PULSE
LIVE0signals / 24h
ES
FEED
vulnKEV agrega CVE-2026-82078 — PaperCut / NG/MFvulnKEV agrega CVE-2026-81578 — PaperCut / NG/MFvulnKEV agrega CVE-2023-49105 — ownCloud / ownCloudvulnKEV agrega CVE-2026-53362 — Linux / KernelvulnKEV agrega CVE-2026-66384 — JFrog / ArtifactoryvulnKEV agrega CVE-2021-23758 — Ajax.NET Professional / Ajax.NET ProfessionalvulnKEV agrega CVE-2015-3246 — Red Hat / LibuservulnKEV agrega CVE-2015-5287 — Red Hat / Automatic Bug Reporting ToolvulnKEV agrega CVE-2022-0995 — Linux / KernelvulnKEV agrega CVE-2026-8452 — Citrix / NetScaler ADC and NetScaler GatewayvulnKEV agrega CVE-2019-1068 — Microsoft / SQL ServervulnKEV agrega CVE-2026-60004 — Gitea / GiteavulnKEV agrega CVE-2026-21962 — Oracle / HTTP Server and Oracle Weblogic Server Proxy Plug-invulnKEV agrega CVE-2026-73570 — Synacor / Zimbra Collaboration Suite (ZCS)vulnKEV agrega CVE-2026-82078 — PaperCut / NG/MFvulnKEV agrega CVE-2026-81578 — PaperCut / NG/MFvulnKEV agrega CVE-2023-49105 — ownCloud / ownCloudvulnKEV agrega CVE-2026-53362 — Linux / KernelvulnKEV agrega CVE-2026-66384 — JFrog / ArtifactoryvulnKEV agrega CVE-2021-23758 — Ajax.NET Professional / Ajax.NET ProfessionalvulnKEV agrega CVE-2015-3246 — Red Hat / LibuservulnKEV agrega CVE-2015-5287 — Red Hat / Automatic Bug Reporting ToolvulnKEV agrega CVE-2022-0995 — Linux / KernelvulnKEV agrega CVE-2026-8452 — Citrix / NetScaler ADC and NetScaler GatewayvulnKEV agrega CVE-2019-1068 — Microsoft / SQL ServervulnKEV agrega CVE-2026-60004 — Gitea / GiteavulnKEV agrega CVE-2026-21962 — Oracle / HTTP Server and Oracle Weblogic Server Proxy Plug-invulnKEV agrega CVE-2026-73570 — Synacor / Zimbra Collaboration Suite (ZCS)
← All CVEs
CVE WatchSep 2, 2026

CVE-2026-81775

Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

CVSS

7.1

High

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Sep 2, 2026 · Last modified: Sep 2, 2026 · CWE-79

EPSS · 30d

Not enough EPSS history yet.

Technical description

Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-848039.0 CRI
—
——0SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.3hCVE-2026-847934.8 MED
—
——0Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.3hCVE-2026-847816.5 MED
—
——0Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.3hCVE-2026-835626.5 MED
—
——0Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.3hCVE-2026-817717.1 HIG
—
——0Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.3hCVE-2026-817707.1 HIG
—
——0Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.3h