CVE-2026-77115

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...

immich -- open redirect and reflected XSS in maintenance endpoint

The immich project reports: The /maintenance endpoint fails to validate the continue URL parameter. When maintenance mode is disabled, which is the default, the application accepts unvalidated redirect targets, enabling both open redirects and reflected cross-site scripting. An unauthenticated us...

CVE-2026-33240

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

EUVD-2026-64175

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

CVE-2026-33240

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API prior to version 3.2.3 . The flaw allows an attacker to inject malicious scripts that execute in a victim's browser when they interact ...

CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

CVE-2026-69234

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

CVE-2026-30890

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...

CVE-2026-31803

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3...

CVE-2026-31880

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-30865

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30826

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-31880

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search feature. The flaw allows an authenticated attacker (low privileges required, user interaction required) to inject malicious scripts via the search int...

CVE-2026-31880 Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

EUVD-2026-64164

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-31880 Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-69234 reflected cross site scripting vulnerability in Esri Portal for ArcGIS

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

CVE-2026-69234

Esri Portal for ArcGIS versions 11.5 and prior contain a reflected cross-site scripting (XSS) vulnerability. A remote, unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS 3.1 score is 6.1 (Medium) with...