KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #13

CWE-79: Cross-site scripting (XSS) in CISA KEV

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Catalog
2026.09.23
Rank
#13 of 185
MITRE
CWE-79 definition

Answer 33 KEV entries list CWE-79 (Cross-site scripting (XSS)) as of catalog 2026.09.23, 1.9% of the catalog and rank 13 of 185 weaknesses. The most affected vendor is Synacor (9).

Attacker-supplied script is included in a web page and runs in other users' browsers.

KEV entries
331.9% of catalog
Vendors
15affected
Ransomware: known
515.2%
First added
2021-11-03
Latest added
2026-05-15

VVendors

Vendors with CWE-79 KEV entries
VendorEntriesShare
Synacor927.3%
Roundcube618.2%
Microsoft26.1%
Apple26.1%
Cisco26.1%
Fortra26.1%
QNAP26.1%
OpenPLC13%
MDaemon13%
JQuery13%
Adobe13%
Meta Platforms13%

TAdditions by year

CWE-79 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 3; 2022: 8; 2023: 6; 2024: 5; 2025: 7; 2026: 4.024682021: 3 added320212022: 8 added820222023: 6 added620232024: 5 added520242025: 7 added720252026: 4 added (year to date)42026
CWE-79 KEV additions by year
YearAdded
20213
20228
20236
20245
20257
20264

PProducts

Products with CWE-79 KEV entries
ProductEntriesShare
Synacor Zimbra Collaboration Suite (ZCS)824.2%
Roundcube Webmail515.2%
Fortra Cobalt Strike26.1%
QNAP Network Attached Storage (NAS)26.1%
Microsoft Microsoft13%
OpenPLC ScadaBR13%
MDaemon Email Server13%
JQuery JQuery13%

EAll entries

KEV entries listing CWE-79
CVEVendorProductAddedRansomware
CVE-2026-42897MicrosoftMicrosoftUnknown
CVE-2025-48700SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2025-66376SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2025-68461RoundcubeWebmailUnknown
CVE-2021-26829OpenPLCScadaBRUnknown
CVE-2025-27915SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2024-42009RoundcubeWebmailUnknown
CVE-2024-27443SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2024-11182MDaemonEmail ServerUnknown
CVE-2023-34192SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2020-11023JQueryJQueryUnknown
CVE-2024-44309AppleMultiple ProductsUnknown
CVE-2014-2120CiscoAdaptive Security Appliance (ASA)Unknown
CVE-2024-37383RoundcubeWebmailUnknown
CVE-2024-43573MicrosoftWindowsUnknown
CVE-2023-43770RoundcubeWebmailUnknown
CVE-2023-5631RoundcubeWebmailUnknown
CVE-2023-37580SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2020-35730RoundcubeRoundcube WebmailUnknown
CVE-2022-27926SynacorZimbra Collaboration Suite (ZCS)Unknown
CVE-2022-42948FortraCobalt StrikeUnknown
CVE-2022-39197FortraCobalt StrikeUnknown
CVE-2012-0767AdobeFlash PlayerUnknown
CVE-2018-19953QNAPNetwork Attached Storage (NAS)Known
CVE-2018-19943QNAPNetwork Attached Storage (NAS)Known
CVE-2019-18426Meta PlatformsWhatsAppUnknown
CVE-2018-6882SynacorZimbra Collaboration Suite (ZCS)Known
CVE-2019-3929CrestronMultiple ProductsUnknown
CVE-2013-5223D-LinkDSL-2760UUnknown
CVE-2022-24682SynacorZimbra Collaborate Suite (ZCS)Known
CVE-2021-1879AppleiOS, iPadOS, and watchOSUnknown
CVE-2020-3580CiscoAdaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Known
CVE-2019-9978WordPressSocial Warfare PluginUnknown

Cite this

33 CISA KEV entries list CWE-79 (Cross-site scripting (XSS)), 1.9% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-79/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API