CVE-2026-21269 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...

CVE-2026-21269

CVE-2026-21269 (Adobe ColdFusion) describes a stored cross-site scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript could execute in a victim’s browser when visiting the page containing th...

CVE-2026-71386 ColdFusion | Cross-site Scripting (XSS) (CWE-79)

is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...

CVE-2026-71386 ColdFusion | Cross-site Scripting (XSS) (CWE-79)

is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...

CVE-2026-71386

CVE-2026-71386 is a cross-site scripting vulnerability affecting Adobe ColdFusion (ColdFusion component). The issue can lead to arbitrary code execution in the context of the current user and is exploitable only when a victim opens a malicious file, with user interaction required. The vulnerable ...

Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-53666 DESCRIPTION: React...

Rocket.Chat: Stored HTML Injection (CWE-79) via Livechat Visitor Name

Vulnerability description not provided...

Automated Logic WebCTRL Cross-site Scripting (CVE-2024-5540)

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in Automated Logic WebCTRL and Carrier i-Vu Building Automation System products in versions older than 8.0. Untrusted data is included in web pages without proper validation, allowing...

CVE-2026-47981 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's...

PT-2026-24662

Name of the Vulnerable Software and Affected Versions mlflow/mlflow versions prior to 3.10.0 Description An unauthenticated remote attacker can read arbitrary files from the server's filesystem. The issue occurs in the create model version handler of mlflow/server/handlers.py when a...

XSS in LDAP server option

...

CaseAware a360inc - Cross-Site Scripting

a360inc CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. This is a bypass of the fix reported in 2017 id: CVE-2024-25669 info: name: CaseAware a360inc - Cross-Site Scripting author: r3naissance severity: medium...

Odoo - Cross-Site Scripting

Odoo is a business suite that has features for many business-critical areas, such as e-commerce, billing, or CRM. Versions before the 16.0 release are vulnerable to CVE-2023-1434 and is caused by an incorrect content type being set on an API endpoint. id: CVE-2023-1434 info: name: Odoo - Cross-Si...

CVE-2021-22723

A CWE-79: Improper Neutralization of Input During Web Page Generation Cross-siteScripting through Cross-Site Request Forgery CSRF vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and...

CVE-2021-22822

A CWE-79 Improper Neutralization of Input During Web Page Generation �Cross-site Scripting� vulnerability exists that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the chargi...

CVE-2020-7546

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software see security notification for version information that could allow an attacker to perform actions on behalf of the authorized user when...

CVE-2022-38376

Multiple improper neutralization of input during web page generation 'Cross-site Scripting' vulnerabilities CWE-79 in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests...

CVE-2026-22042 RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he ImportIam admin API validates permissions using ExportIAMAction instead of ImportIAMAction, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data...

CVE-2025-68705 RustFS Path Traversal Vulnerability

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/readfilestream endpoint. This issue has been patched in version 1.0.0-alpha.79...

CVE-2025-68705 RustFS Path Traversal Vulnerability

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/readfilestream endpoint. This issue has been patched in version 1.0.0-alpha.79...