EUVD-2026-74218

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-75657

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction — the victim must visit a crafted webpa...

CVE-2026-28659

In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-69642

Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...

Vulnerabilities in Microsoft Exchange servers

Microsoft has identified 9 vulnerabilities in Exchange Server. A malicious individual can exploit these vulnerabilities to carry out Denial-of-Service attacks, impersonate other users, gain elevated privileges, execute arbitrary code, and/or access sensitive data. The most severe vulnerability,...

CVE-2026-69642

CVE-2026-69642 is a cross-site scripting (XSS) vulnerability in Skype for Business Server (Subscription Edition, 2019, and 2015), caused by improper input neutralization during web page generation. An unauthorized attacker can perform spoofing over a network with no user interaction or privileges...

EUVD-2026-73938

Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-73936

Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-63523

CVE-2026-63523 is a stored cross-site scripting (XSS) vulnerability in Skype for Business Server , affecting the Subscription Edition , 2019 , and 2015 releases. The flaw stems from improper neutralization of input during web page generation, allowing an unauthenticated attacker to perform spoofi...

CVE-2026-86074

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-69690

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69615

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69417

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69402

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-69356

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-62895

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Origin Validation Error

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Origin Validation Error due to missing issuer and audience validation in decodeandvalidateazurejwt in...

CVE-2026-76201

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in form fields. An attacker can inject malicious JavaScript that executes in a victim's browser when the vulnerable page is viewed, potentially granting elevated access or control over the victim's account or...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...