CVE-2026-63169

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the messenger's HTMLPurifier SafeIframe branch, which fails to properly neutralize input, allowing authenticated users to post messages containing attacker-con...

CVE-2026-83960 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-48398

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interacti...

CVE-2026-110082

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can execute malicious JavaScript within a victim's browser by tricking them into visiting a URL referencing a vulnerable page. The vulnerability has a MEDIUM base sever...

CVE-2026-110080 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110078 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110078

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interacti...

CVE-2026-110076

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this issue by manipulating the DOM environment to execute malicious JavaScript within a victim's browser. Successful exploitation requires user interaction , specifically...

CVE-2026-110074

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interacti...

EUVD-2026-100539

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-106628

Adobe Experience Manager is impacted by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79 ). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interact...

CVE-2026-110101

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-110101 Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2025-28073

CVE-2025-28073 Suggested description phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Vulnerability Type Cross Site Scripting XSS Vend...

CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...

CVE-2026-63357

Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially craft...

CVE-2026-63351

Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into...

CVE-2026-63350

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow...

CVE-2026-39107

CVE-2026-39107: Cross-Site Scripting XSS in Kimi AI v1.0 Description A Cross-Site Scripting XSS vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches...

CVE-2026-63356

Affected devices are vulnerable to a Cross-Site Scripting (XSS) flaw because they fail to properly sanitize calculated signal names from imported CSV trace files . If these names are included in error messages on the Trace page, an attacker could socially engineer an authorized user with "Read di...