EUVD-2026-85774

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-61823: Improper Neutralization of Input During Web Page Generation

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-4637: Improper Neutralization of Input During Web Page Generation

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...

PT-2026-97727

Name of the Vulnerable Software and Affected Versions Rancher affected versions not specified Description An unauthenticated attacker can perform an update of public UI settings to plant malicious content that executes in the browser of users visiting the login page. This stored Cross-Site...

PT-2026-98242

Name of the Vulnerable Software and Affected Versions code16 Sharp versions prior to 9.22.5 Description A stored cross-site scripting issue exists in the rich-text editor because the HTML sanitizer allows the srcdoc attribute on iframe elements. While markup within srcdoc is HTML-encoded during...

CVE-2026-18872

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

EUVD-2026-85354

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

CVE-2026-18872 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

CVE-2026-18872

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) . The flaw exists in the FTM UI NetworkAcknowledgement React component (specifically at NetworkAcknowledgement.jsx:42), where a malicious actor can inject scripts into stored network...

CVE-2026-18872 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of unescaped filenames from the filesystem in the backend sync page. An attacker can execute arbitrary JavaScript in the browser of backend users by placing specially crafted files with malicio...

REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

Summary A stored cross-site scripting XSS vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's name field without HTML escaping. An attacker with...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the mediaIsInUse function. An attacker can execute arbitrary JavaScript in the context of an administrator's browser session by injecting malicious payloads into the type name field, which are rendered...

CVE-2026-5696 Multiple vulnerabilities in the Microweber administration panel

Reflected Cross-Site Scripting XSS in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This...

CVE-2026-5696

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Microweber administration panel. The flaw is located within the 'group' parameter of the '/admin/settings' endpoint. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code i...

Improper Cookie Domain

Http4s is vulnerable to improper cookie domain. The vulnerability is due to unanchored substring checks instead of RFC 6265-compliant domain and path matching when attaching stored cookies, which allows an attacker to exploit an application’s attacker-influenced outbound request to obtain session...

PT-2026-97279

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-18872: Improper Neutralization of Input During Web Page Generation

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

PT-2026-97355

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Stored cross-site scripting occurs in the FTM UI NetworkAcknowledgement React component within the file NetworkAcknowledgement.jsx:42. A...

CVE-2026-75698

Adobe Connect is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user...