PT-2026-97355

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Stored cross-site scripting occurs in the FTM UI NetworkAcknowledgement React component within the file NetworkAcknowledgement.jsx:42. A...

PT-2026-97501

Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31 Description The anonymous endpoint 'formie/submissions/submit' in the SubmissionsController::actionSubmit function trusts a client-supplied submissionId when loading incomplete...

CVE-2026-84706: Incomplete List of Disallowed Inputs

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list an ANSIBLE prefix check plus a fixed ENVBLOCKLIST that omits process-hijacking loader variables such as BASHENV, ENV,...

CVE-2026-75698

Adobe Connect is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user...

CVE-2026-75698

Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this flaw by tricking a victim into visiting a maliciously crafted URL or interacting with a compromised web page. Successful exploitation allows the attacker to inject malicious sc...

EUVD-2026-84781

Adobe Connect is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user...

CVE-2026-75684 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-75697 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

UBUNTU-CVE-2026-63374

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connecttcp and TLSStream.wrap can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a...

CVE-2026-95665

MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...

CVE-2026-95682

MISP contains a stored XSS in the admin email composition screen . The MISP.org organization name was interpolated into a JavaScript string literal via an unescaped PHP echo (var org = ""), so a name containing a double-quote or backslash could terminate the literal and inject arbitrary script. T...

EUVD-2026-84399

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-95682 MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...

CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...

CVE-2026-95665

MISP contains a reflected XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without hex...

CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...

OpenPLC Runtime v3

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives. 2. RECOMMENDED...

Apache OFBiz 17.12.03 - Cross-Site Scripting

Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request. id: CVE-2020-9496 info: name: Apache OFBiz 17.12.03 - Cross-Site Scripting author: dwisiswant0 severity: medium description: Apache OFBiz 17.12.03 contains cross-site scripting a...

PT-2026-96723

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a...

CVE-2026-95665: Improper Neutralization of Input During Web Page Generation

MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...