# CWE-84. Every Advisory and CVE whose sources give the weakness CWE-84, newest first. ## Records, newest first - [Plex Media Server URL injection](https://agentprime.io/advisories/CVE-2026-96654.md) `CVE-2026-96654` · CVE record: Plex Media Server · CVSS 6.9 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-84 - [Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction](https://agentprime.io/advisories/CVE-2026-88859.md) `CVE-2026-88859` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 3 more · CVSS 6.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-84 - [Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)](https://agentprime.io/advisories/CVE-2026-54443.md) `CVE-2026-54443` · CVE record: lissy93 dashy · CVSS 5.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-84 - [JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol](https://agentprime.io/advisories/GHSA-vmhf-c436-hxj4.md) `GHSA-vmhf-c436-hxj4`, `BIT-jupyterlab-2026-67338`, `CVE-2026-67338` · PyPI `jupyterlab`: affected `<4.5.9`, fixed in `4.5.9` · CVSS 5.1 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-84 - [Orval has Code Injection via unsanitized x-enum-descriptions using JS comments](https://agentprime.io/advisories/GHSA-gch2-phqh-fg9q.md) `GHSA-gch2-phqh-fg9q`, `CVE-2026-25141` · npm `@orval/core`: affected `>=7.19.0, <7.21.0 || >=8.0.0, <8.2.0`, fixed in `7.21.0`, `8.2.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jan 2026 · Tags: Code injection, CWE-84 - [MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server](https://agentprime.io/advisories/GHSA-g9hg-qhmf-q45m.md) `GHSA-g9hg-qhmf-q45m`, `CVE-2025-58444` · npm `@modelcontextprotocol/inspector`: affected `<0.16.6`, fixed in `0.16.6` · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection, CWE-84 - [IBM Engineering Lifecycle Optimization - Publishing cross-site scripting](https://agentprime.io/advisories/CVE-2024-52890.md) `CVE-2024-52890` · CVE record: IBM IBM Engineering Lifecycle Optimization - Publishing · CVSS 6.1 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: CWE-84 - [Tuleap allows XSS via the content of RSS feeds in the RSS widgets](https://agentprime.io/advisories/CVE-2025-30203.md) `CVE-2025-30203` · CVE record: Enalean tuleap · CVSS 4.8 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: Cross-site scripting (XSS), CWE-84 - [An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25334.md) `CVE-2025-25334` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25331.md) `CVE-2025-25331` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25330.md) `CVE-2025-25330` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25329.md) `CVE-2025-25329` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25326.md) `CVE-2025-25326` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25325.md) `CVE-2025-25325` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25324.md) `CVE-2025-25324` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.](https://agentprime.io/advisories/CVE-2025-25323.md) `CVE-2025-25323` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-84 - [HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme](https://agentprime.io/advisories/CVE-2024-42184.md) `CVE-2024-42184` · CVE record: HCL Software BigFix Patch Management Download Plug-ins · CVSS 2.5 Low · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-84 - [JavaScript Injection via url encoded values in links in Collabora Office Android](https://agentprime.io/advisories/CVE-2024-45045.md) `CVE-2024-45045` · CVE record: CollaboraOnline online · CVSS 6.3 Medium · Not analysed yet · Published 29 Aug 2024 · Tags: CWE-84 - [Stored XSS via javascript URI in Apollo Change Requests comment](https://agentprime.io/advisories/CVE-2023-30959.md) `CVE-2023-30959` · CVE record: Palantir com.palantir.apollo:autopilot · CVSS 4.1 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: CWE-84 - [Cross site scripting Vulnerability in backstage Software Catalog](https://agentprime.io/advisories/GHSA-7hv8-3fr9-j2hv.md) `GHSA-7hv8-3fr9-j2hv`, `CVE-2023-25571` · npm `@backstage/catalog-model` and 2 more: affected `<1.2.0`, fixed in `1.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: Cross-site scripting (XSS), CWE-84 - [Siemens Desigo PXM30-1: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41)…](https://agentprime.io/advisories/CVE-2022-40181.md) `CVE-2022-40181` · CVE record: Siemens Desigo PXM30-1 and 4 more · No CVSS score · Not analysed yet · Published 11 Oct 2022 · Tags: CWE-84 - [OpenVPN Access Server: OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web…](https://agentprime.io/advisories/CVE-2021-3824.md) `CVE-2021-3824` · CVE record: OpenVPN Access Server · No CVSS score · Not analysed yet · Published 23 Sept 2021 · Tags: CWE-84 - [Elastic App Search: Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when…](https://agentprime.io/advisories/CVE-2020-7011.md) `CVE-2020-7011` · CVE record: Elastic Elastic App Search · No CVSS score · Not analysed yet · Published 3 Jun 2020 · Tags: CWE-84 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .