CVE-2026-76960 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

CVE-2026-76960 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

EUVD-2026-72579

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76959 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

PT-2026-87076

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The...

PT-2026-87213

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-78741: Improper Neutralization of Input During Web Page Generation

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

PT-2026-87134

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/asset/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets...

CVE-2026-78738: Improper Neutralization of Input During Web Page Generation

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

PT-2026-88339

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

EUVD-2026-72957

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

EUVD-2026-74260

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

CVE-2026-63523: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-64838: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-87185

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

CVE-2026-85630: Improper Neutralization of Input During Web Page Generation

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...

PT-2026-88453

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value...

PT-2026-88631

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An information leak exists in the Cross-Origin Resource Sharing CORS implementation. A remote attacker who has already compromised the renderer process can use a crafted HTML page to...

PT-2026-88742

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description An uninitialized resource in WebGL allows a remote attacker to leak cross-origin data through the use of a crafted HTML page. Recommendations Update Google Chrome to version 153.0.8010....

PT-2026-88751

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Paint component allows a remote attacker to obtain cross-origin data by using a crafted HTML page. Cross-origin data refers to information belonging to a...