recorded together · two weakness classes
Misconfiguration and Insecure Design and Cross-site Scripting
26 CVEs
26 CVEs name a weakness of both Misconfiguration and Insecure Design and Cross-site Scripting, about what chance alone would give (27). The pairing most often behind it is CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag) with CWE-79 (Cross-site Scripting), in 8 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 26
- Chance alone would give
- about 27
- So they are recorded together
- about as often as chance
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial only for pairs with enough CVEs and clearly above chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- check available
- 1
Every one of the 26 is a mark on the map. Named now: 1 to 26, most at risk first.
- Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting
- ABB System 800xA Information Manager Remote Code Execution
- SiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan
- SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS
- Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
- Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
- SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
- Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
- Gitea Jupyter notebook UI redress through CSS class injection
- SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
- Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
- Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
- Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
- Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
- Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
- Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
- A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker can insert arbitrary JavaScript into their…
- FressRSS: Clickjacking can lead to XSS and/or privilege escalation
- AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection
- Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
- ChurchCRM has Stored XSS in Group Name
- XSS in Mevzuattr Software's MevzuatTR
- ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
- HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain…
- Stored Cross-site Scripting (XSS) in Kentico Xperience 13
- Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.