CVE-2026-85630

HTML::FormHandler versions before 0.410002 (Perl) fail to escape field attributes in the process_attrs method when rendering HTML. Any application where field attributes are built from data rather than literals allows an attacker to inject text that overrides attributes or embeds JavaScript, enab...

CVE-2026-85485

HTML::FormHandler for Perl (versions before 0.410002 ) fails to HTML-escape error messages in the Table form layout and the Bootstrap 2 and 3 wrappers , splicing raw error strings directly into surrounding markup. Attacker-influenced content, such as rejected field values, could embed JavaScript ...

CVE-2026-78552

CVE-2026-78552 is a validation bypass in Okta Access Gateway where the application-level custom configuration field is not subject to the same Lua directive restriction as other fields. Because this field is interpolated directly into the nginx server block without inspection, an authenticated us...

CVE-2026-85484

HTML::FormHandler versions before 0.410002 for Perl contain an HTML injection flaw. The Select , RadioGroup , CheckboxGroup , and HorizCheckboxGroup widgets render option group labels and radio button labels into HTML without escaping. When an application builds its option list from data (via opt...

CVE-2026-19872

HTML::FormHandler versions before 0.410000 for Perl are vulnerable to cross-site scripting (XSS) because its error wrappers and renderers interpolate error strings directly into HTML without escaping. The library's own no_match and not_allowed messages splice a submitted value into the error stri...

CVE-2026-78623

Okta Access Gateway contains an SQL injection vulnerability in its advanced mode datastore configuration . The root cause is that SAML assertion values are interpolated directly into database query strings without sanitization , prior to query preparation, allowing unintended SQL execution agains...

CVE-2026-78550

The Okta Access Gateway management console is vulnerable to improper input handling in its exception handler . During an authenticated administrator SSH session, user-supplied input is passed to eval() without sanitization, resulting in arbitrary code execution with the privileges of the manageme...

CVE-2026-78545

Okta Access Gateway is vulnerable to improper input sanitization in the application label field. The unsanitized value is interpolated directly into an nginx server block directive within the generated configuration file, allowing an attacker to inject arbitrary directives. This requires high pri...

CVE-2026-84197

Eclipse Ditto's Node.js JavaScript client hard-codes rejectUnauthorized: false in its WebSocket transport, disabling TLS certificate chain and hostname validation for every wss:// connection. All released versions of @eclipse-ditto/ditto-javascript-client-node (2.0.0–3.9.0) and its predecessor @e...

CVE-2026-86810

Open-Web-Analytics (up to 1.9.1) contains an improper authentication vulnerability in the checkCapabilityAndAuthenticateUser function within Core/Controller.php (Controller component). A remote, unauthenticated attacker can manipulate this function to bypass authentication checks. The CVSS 3.1 sc...

CVE-2026-87049

A flaw in operator-foundry allows untrusted external actors to exploit over-permissive GitHub access tokens and GCP Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking the workflow on untrusted-triggerable events (e.g., pull_request_target, issue_comme...

CVE-2026-75678

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation requires user interaction —the victim mu...

CVE-2026-71357

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript in the victim's browser. Exploitation requires user interaction —the victim must visit a crafted webpage. The CVSS ...

CVE-2026-71565

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —the victim must visi...

CVE-2026-75687

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser. Exploitation requires user interaction : the victim must visit a cra...

CVE-2026-75672

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript in the victim's browser, but exploitation requires user interaction —specifically, the victim must visit a crafted ...

CVE-2026-75734

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields; the script executes in a victim's browser when they browse the affected page. The vulnerability yields low confid...

CVE-2026-75706

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79 ). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction (the victim must visit a crafted webpa...

CVE-2026-75719

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker with low privileges can manipulate the DOM environment to execute malicious JavaScript in the victim's browser, but exploitation requires the victim to visit a crafted webpage . The ...

CVE-2026-75730

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields , causing arbitrary JavaScript to execute in a victim's browser when they view the affected page. The CVSS 3.1 sco...

CVE-2026-75707

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context, with scope changed and low impacts on confidentiality and integrity but no ava...

CVE-2026-75690

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , as the victim must visit a crafted we...

CVE-2026-75715

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79 ). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —the victim must vis...

CVE-2025-64838

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they view the page containing the injected content. The CVSS v3.1 score ...

CVE-2026-75646

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , specifically the victim must visit a ...

CVE-2026-75640

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , as the victim must visit a crafted we...

CVE-2026-75726

Adobe Experience Manager is affected by an Improper Input Validation (CWE-20) vulnerability that can lead to a security feature bypass , allowing a low-privileged attacker to gain unauthorized limited write access . Exploitation requires user interaction —the victim must visit a maliciously craft...

CVE-2026-75643

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses the affected page, the injected JavaScript executes in their browser, with change...

CVE-2026-19612

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction , as the victim must visi...

CVE-2026-75660

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction —the victim must visit a crafted webpage—an...

CVE-2026-19479

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —the victim must visit a crafted webpag...

CVE-2026-75735

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in vulnerable form fields. A low-privileged attacker can inject malicious scripts that execute in a victim's browser when the victim browses the affected page. The CVSS v3.1 score is 5.4 (Medium) wi...

CVE-2026-75637

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability classified as CWE-79 . An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , specif...

CVE-2026-75694

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , as the victim must visit a crafted we...

CVE-2026-75705

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , as the victim must visit a crafted we...

CVE-2026-75741

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript that executes in a victim's browser when they view the affected page. The CVSS 3.1 base score is 5.4 (MEDIUM) wit...

CVE-2026-75679

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —specifically, a victim must visit a cr...

CVE-2025-64830

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields; when a victim browses the affected page, the injected JavaScript executes in their browser. The changed scope ind...

CVE-2026-75729

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the affected page is viewed. The CVSS 3.1 score is 5.4 (Medium) wit...

CVE-2026-75685

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction , as the victim must visit a crafted webpag...

CVE-2026-75677

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —a victim must visit a crafted webpage—...

CVE-2026-75642

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon viewing the page. The CVSS 3.1 score is 5.4 (MEDIUM) with a vector o...

CVE-2026-75671

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript in the victim's browser, with user interaction required (the victim must visit a crafted webpage)...

CVE-2026-75667

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript in the victim's browser. Exploitation requires user interaction (the victim must visit a crafted ...

CVE-2026-75644

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when they browse the affected page. The CVSS v3.1 score is 5.4 (MEDIUM) ...

CVE-2026-75636

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker with low privileges can exploit this by manipulating the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction —the ...

CVE-2026-75704

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction : the victim must vis...

CVE-2026-75708

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , specifically that a...

CVE-2025-64866

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in form fields. A low-privileged attacker can inject malicious scripts, which execute in a victim's browser when the page containing the vulnerable field is viewed. The CVSS 3.1 score is 5.4 (Medium...

CVE-2025-64854

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields , and malicious JavaScript may execute in a victim's browser when they view the page containing the field. The CVS...