CVE-2026-94211

Hyve5 Leantime versions up to 3.9.8 are affected by a stored cross-site scripting (XSS) vulnerability in the Project Dashboard component, specifically the file /app/Domain/Dashboard/Templates/show.blade.php. An attacker with EDIT permission can plant a malicious payload in a label name , which is...