CVE-2026-110081: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-111380

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC Drive Controller CPU 1504D TF affected versions not specified Description Devices do not properly restrict executable content within imported trace files. An attacker could social engineer an authorized user with the "Read...

PT-2026-111387

Name of the Vulnerable Software and Affected Versions Siematic affected versions not specified Description Devices fail to properly sanitize calculated signal data within imported calculated signal files before rendering the information on the Trace page. An attacker could social engineer an...

PT-2026-111382

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon PLC affected versions not specified Description Devices fail to properly sanitize calculated signal data within imported CSV trace files before displaying it on the Trace page. An attacker could trick an authorized...

PT-2026-111381

Name of the Vulnerable Software and Affected Versions Siematic S7-1500 affected versions not specified Description Devices fail to properly validate and sanitize visual properties of calculated signals within imported CSV trace files before they are rendered on the Trace page. An attacker could u...

CVE-2026-78557: Improper Neutralization of Input During Web Page Generation

A vulnerability has been identified in Industrial Edge App Publisher All versions V1.27.9. The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for...

CVE-2026-63351: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into...

CVE-2026-63169: Improper Neutralization of Input During Web Page Generation

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is...

CVE-2025-71430 Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of othe...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the improper cleaning of signal data calculated from imported CSV trace files. It may allow attackers to induce users with permission for the “Read diagnostics” function to...

CVE-2026-103524

Thelia v2.6.0 is susceptible to multiple stored XSS vulnerabilities within its administrative interface. The root cause is the storage of user-supplied input without sufficient output encoding or sanitization , which is subsequently rendered in the administrator interface and web store product pa...

CVE-2026-103524 CVE-2026-103524

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary...

CVE-2026-109300: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

PT-2026-110724

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.13 Description A DOM-based cross-site scripting issue exists in the control panel login and 2FA verification flow. The problem occurs because the returnUrl variable, which is controlled by the user, accept...

CVE-2026-103524: Improper Neutralization of Input During Web Page Generation

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary...

CVE-2026-87762: Improper Neutralization of Input During Web Page Generation

The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store...

EUVD-2026-96346

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-106138

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...