PT-2026-111130

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A DOM-Based Cross-Site Scripting XSS issue exists where an unauthenticated attacker can create a malicious link. When an authenticated user visits this link,...

PT-2026-111131

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description Applications based on SAP GUI for HTML do not sufficiently sanitize user-supplied content in certain functionality. This allows an authenticated attacker to send...

CVE-2026-100133: Improper Neutralization of Input During Web Page Generation

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

PT-2026-113311

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-110219: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescape...

Microsoft SharePoint: CVE-2026-88208: Microsoft Office SharePoint Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

PT-2026-111385

Name of the Vulnerable Software and Affected Versions Siematic S7 affected versions not specified Description Devices fail to properly sanitize signal names within imported CSV trace files before they are rendered in selection menus on the Trace page. This flaw allows an attacker to trick an...

PT-2026-113304

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113303

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-113305

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-113301

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description Stored Cross-Site Scripting XSS allows an attacker to inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, the...

PT-2026-113012

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. This...

PT-2026-113312

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description A stored Cross-Site Scripting XSS issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. This results in the execution of malicious...

PT-2026-113317

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description Adobe Experience Manager contains a DOM-based Cross-Site Scripting XSS flaw, which occurs when an application contains client-side JavaScript that processes data from an...

PT-2026-111845

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the AdminHotelFeaturePricesSettings form. The application echoes the feature price name and impact value POST values without proper escaping when...

PT-2026-112873

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment preNode.innerHTML = p metaData in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can...

CVE-2026-110082: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is...

PT-2026-113297

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 23.0.5 Vitess versions prior to 24.0.2 Description The twopczHandler function in go/vt/vttablet/tabletserver/twopcz.go fails to perform HTML escaping when writing Action and dtid form values from the /twopcz HTTP debug...

PT-2026-111180

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.1 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description An issue exists where improper sanitization of HTML attributes in syntax-highlighted output allows an...

CVE-2026-106631: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...