CVE-2026-76002 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed...

CVE-2026-76002

Adobe ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). If an attacker can convince a victim to visit a crafted URL referencing a vulnerable page, malicious JavaScript may execute within the victim's browser context. The CVSS 3.1 score is 6.1 (MEDIUM) with a...

EUVD-2026-74073

ColdFusion is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed...

CVE-2026-81824

The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link...

GHSA-C2JG-2778-GGM4 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

CVE-2026-76201

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in form fields. An attacker can inject malicious JavaScript that executes in a victim's browser when the vulnerable page is viewed, potentially granting elevated access or control over the victim's account or...

EUVD-2026-74036

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

EUVD-2026-74037

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-81824 AVEVA Pipeline Integrity Monitor cross-site scripting

The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link...

CVE-2026-81824

CVE-2026-81824 affects AVEVA Pipeline Integrity Monitor (PIMBoards) and is a cross-site scripting (XSS) vulnerability. If exploited, it allows an attacker to execute arbitrary JavaScript code in the browser session of a PIMBoards user who was socially engineered into clicking a malicious link. Th...

EUVD-2026-73928

The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link...

CVE-2026-81824 AVEVA Pipeline Integrity Monitor cross-site scripting

The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

Exploit for CVE-2026-73319

CVE-2026-73319 XenForo before 2.3.13 accepts a same-host jav...

CVE-2026-78838

A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...

CVE-2026-73319

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

EUVD-2026-72756

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-73319 XenForo < 2.3.13 XSS via Dynamic Redirect Handler

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...