PT-2026-113345

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113314

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113317

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description Adobe Experience Manager contains a DOM-based Cross-Site Scripting XSS flaw, which occurs when an application contains client-side JavaScript that processes data from an...

CVE-2026-110081: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-63351: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into...

CVE-2026-110077: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110076: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-104587: Improper Neutralization of Input During Web Page Generation

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting XSS vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An...

CVE-2026-110037: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-106628: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110078: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-109748: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109761: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109749: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

Security Vulnerabilities fixed in Firefox ESR 115.43 — Mozilla

Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-109706: Use-after-free in the Storage: IndexedDB component Reporter Mozilla Impact high...

CVE-2026-110075: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110080: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-63169: Improper Neutralization of Input During Web Page Generation

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is...

CVE-2026-110079: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-111387

Name of the Vulnerable Software and Affected Versions Siematic affected versions not specified Description Devices fail to properly sanitize calculated signal data within imported calculated signal files before rendering the information on the Trace page. An attacker could social engineer an...