CVE-2026-102982 Plane: XSS in work item comments

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the lin...

CVE-2026-102982 Plane: XSS in work item comments

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the lin...

CVE-2026-76975

Due to a DOM-Based Cross-Site Scripting XSS vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper...

CVE-2026-76972

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-76976

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP are vulnerable to a Cross-Site Scripting (XSS) vulnerability due to insufficient sanitization of user-supplied content in certain functionalities. An authenticated attacker can send malicious content to another user; ...

CVE-2026-76976 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

EUVD-2026-98185

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Overview Shopware 6.7 contains a stored cross-site scripting XSS vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It...

CVE-2026-76976: Improper Neutralization of Input During Web Page Generation

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

CVE-2026-76975: Improper Neutralization of Input During Web Page Generation

Due to a DOM-Based Cross-Site Scripting XSS vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper...

CVE-2026-102982: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the lin...

PT-2026-111130

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A DOM-Based Cross-Site Scripting XSS issue exists where an unauthenticated attacker can create a malicious link. When an authenticated user visits this link,...

CVE-2026-3096 Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft

The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations. This vulnerability could all...

CVE-2026-76002

ColdFusion is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed...

CVE-2026-75678 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-75646 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-75709

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —the victim must visit a crafted webpag...

CVE-2026-75647

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , as the victim must visit a crafted we...

CVE-2026-75668 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...