EUVD-2026-56702

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-56700

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-56602

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

EUVD-2026-56590

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-57104

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-56416

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network...

CVE-2026-57105

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-56292

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

EUVD-2026-56291

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-21269 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope ...

CVE-2026-21269

is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope ...

CVE-2026-71386 ColdFusion | Cross-site Scripting (XSS) (CWE-79)

is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...

EUVD-2026-56538

is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...

EUVD-2026-56218

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...

CVE-2026-18247 DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals

A Cross Site Scripting XSS vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session...

CVE-2026-72925 SWC HTML minifier may allow script element breakout when minifying embedded JSON

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...

CVE-2026-19434

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Azure Storage Explorer Elevation of Privilege Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network...

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network...