EUVD-2026-65005

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...

CVE-2026-34491

A persistent cross-site scripting (XSS) vulnerability in the web interface of Johnson Controls Metasys (a building management system) allows a low-privilege user to inject a malicious payload via a crafted URL. The payload persists across logins and executes in the browser context of other users,...