PT-2026-77084

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

PT-2026-78011

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Endeca Application Controller component allows a low privileged attacker with network access via HTTP to compromise the system. The...

CVE-2026-66638: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-80393

Apache Answer vulnerable to Cross-site Scripting in github.com/apache/answer...

PT-2026-77099

Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...

CVE-2026-66629: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...

CVE-2026-30250

Beta Systems Software AG ANOW! Automate v.3.3.1.90 is vulnerable to a Cross-site scripting (XSS) vulnerability within the user documentation field . This flaw allows a remote attacker to execute arbitrary code. While the vulnerability is documented as XSS, the description explicitly notes the pot...

CVE-2026-30250

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

PT-2026-77077

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

PT-2026-77222

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This occurs when a malicious payload is included in the loadTemplate...

PT-2026-77996

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An unauthenticated attacker with network access via HTTP can compromise the Experience Manager component. This issue requires human interaction from ...

PT-2026-77066

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-77276

Name of the Vulnerable Software and Affected Versions Otalio Ship Property Management System versions prior to 2.22.0 Description Unescaped stored values in the application security page allow authenticated attackers to escalate privileges via persistent cross-site scripting XSS, a technique wher...

PT-2026-77060

Name of the Vulnerable Software and Affected Versions Kirki versions prior to 6.2.4 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by injecting code into a web page. Recommendations Update to a...

PT-2026-77068

Name of the Vulnerable Software and Affected Versions Login With Ajax versions prior to 4.5.2 Description Cross Site Scripting XSS exists in the contributor section, allowing an attacker to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 4.5...

PT-2026-77217

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

PT-2026-76924

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...

PT-2026-77052

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

PT-2026-77443

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Scripting versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Scripting product. A low privileged attacker with network access via HTTP can exploit this...

PT-2026-76948

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...