CVE-2026-102755

DataEase, an open-source data visualization tool, is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.10.26 . Authenticated users with folder creation permissions can inject HTML-bearing names via the datasource/createFolder or datasetTree/save endpoints. The vulnerability o...