Improper Neutralization of Alternate XSS Syntax

Every one of the 49 is a mark on the map. Named now: 1 to 26, most at risk first.

1. XWiki >= 6.2-milestone-1 - Cross-Site ScriptingCVE-2023-35161xwiki · CVSS 9.7 · 2.4% likely

   Xwiki

2. XWiki >= 2.5-milestone-2 - Cross-Site ScriptingCVE-2023-35160xwiki · CVSS 9.7 · 2.3% likely

   Xwiki

3. XWiki >= 3.4-milestone-1 - Cross-Site ScriptingCVE-2023-35159xwiki · CVSS 9.7 · 2.2% likely

   Xwiki

4. XWiki >= 6.0-rc-1 - Cross-Site ScriptingCVE-2023-35156xwiki · CVSS 9.7 · 2.1% likely

   Xwiki

5. XWiki - Cross-Site ScriptingCVE-2023-35158xwiki · CVSS 9.7 · 2.0% likely

   Xwiki

6. DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG uploadCVE-2026-40321dnnsoftware · CVSS 8.1 · 6.4% likely

   DNNSoftware

7. jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabledCVE-2022-36033jhy · CVSS 6.1 · 1.6% likely
8. Reflected XSS when importing CSV in OctoberCMSCVE-2020-5298octobercms · CVSS 4 · 0.9% likely

   October CMS

9. Cisco Common Services Platform Collector Stored Cross-Site Scripting VulnerabilityCVE-2021-40131Cisco · CVSS 5.5 · 0.7% likely

   Cisco

10. Improper Neutralization of Alternate XSS Syntax in Knowage-ServerCVE-2022-39295KnowageLabs · CVSS 6.1 · 0.7% likely

    KnowageLabs

11. Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`CVE-2026-54002getkirby · CVSS 8.5 · 0.5% likely

    Getkirby

12. A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)…CVE-2022-20963Cisco · CVSS 5.4 · 0.5% likely

    Cisco

13. Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]CVE-2025-27793vega · CVSS 5.3 · 0.5% likely

    Vega

14. DOM-Based XSS in Ory Polis Login PageCVE-2026-33506ory · CVSS 8.8 · 0.5% likely

    Ory

15. A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business…CVE-2023-20188Cisco · CVSS 4.8 · 0.5% likely

    Cisco

16. A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based managemen…CVE-2023-20208Cisco · CVSS 4.8 · 0.5% likely

    Cisco

17. reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record PoisoningCVE-2024-43381yogeshojha · CVSS 5 · 0.4% likely

    Yogeshojha

18. Node-SAML SAML Authentication BypassCVE-2025-54369node-saml · CVSS 9.3 · 0.4% likely

    Node-Saml

19. Apache Answer: XSS in AI Answer RenderingCVE-2026-25688Apache Software Foundation · CVSS 6.1 · 0.4% likelycovered by CyberSIXT

    Apache

20. TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemesCVE-2026-55661tinacms · CVSS 4.8 · 0.4% likely

    Tinacms

21. WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label ParameterCVE-2024-8505dcooney · CVSS 6.4 · 0.4% likely

    Dcooney

22. Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerab…CVE-2026-79946Dell · CVSS 5.3 · 0.4% likely

    Dell

23. Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APICVE-2025-14732elemntor · CVSS 6.4 · 0.3% likely

    Elemntor

24. Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget TitlesCVE-2024-4459themesflat · CVSS 6.4 · 0.3% likely

    Themesflat

25. Improper Neutralization of Alternate XSS Syntax in iris-webCVE-2024-25640dfir-iris · CVSS 4.6 · 0.3% likely

    Dfir-Iris

26. n8n: XSS via MCP OAuth clientCVE-2026-42235n8n-io · CVSS 8.8 · 0.3% likely

    N8n-Io

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.