By weakness (CWE)

CWE-79: related vulnerabilities

CVEs classified under CWE-79. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

728 published vulnerabilities · page 6 of 8

• CVE-2026-47949MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability in form fields that allows attackers with basic user privileges to inject malicious JavaScript. When legitimate users view pages containing these compromised fields, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability affects AEM 6.5.24, LTS SP1, 2026.04, and earlier versions.

• CVE-2026-47950MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) flaw that allows low-privileged users to embed malicious scripts into form fields. When other users view pages containing these compromised fields, the attacker's JavaScript runs in their browsers with the victim's permissions. The vulnerability affects multiple AEM versions including 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47951MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability that allows attackers with low-level account privileges to embed malicious code into form fields. When other users visit pages containing these compromised fields, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects multiple AEM versions up to and including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47953MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious scripts. When a victim visits a page containing an affected form field, the injected script executes in their browser with the victim's privileges, potentially compromising their session or stealing sensitive data. The vulnerability affects multiple versions of AEM through 2026.04 and requires authenticated access to exploit, limiting but not eliminating the attack surface.

• CVE-2026-47954MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with basic user privileges to embed malicious code into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers, potentially allowing the attacker to steal credentials, session tokens, or perform actions on behalf of the victim. The vulnerability affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47956MEDIUM 5.4

  Adobe Experience Manager versions through 6.5.24, LTS SP1, and 2026.04 contain a stored cross-site scripting (XSS) flaw in form field handling. An attacker with basic user privileges can inject malicious JavaScript into vulnerable fields. When legitimate users view pages containing these fields, the injected scripts execute in their browsers. This is particularly concerning because the vulnerability changes scope—meaning an attacker could potentially affect other users or system functionality beyond the immediate form context.

• CVE-2026-47957MEDIUM 5.4

  Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. An attacker with low-level system access can inject malicious JavaScript that persists in the application and executes whenever a user views the affected page, potentially allowing credential theft, session hijacking, or malware distribution. The vulnerability requires user interaction—a victim must navigate to the compromised form—but the attacker does not need elevated privileges to introduce the payload.

• CVE-2026-47958MEDIUM 5.4

  Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. A low-privileged user can inject malicious JavaScript that persists in the application and executes when other users view the affected page. Because the vulnerability has a changed scope—meaning the impact crosses trust boundaries—it affects not just the immediate application but potentially other parts of the system or connected domains.

• CVE-2026-47962MEDIUM 5.4

  Adobe Experience Manager is vulnerable to a stored cross-site scripting (XSS) attack where a low-privileged user can inject malicious JavaScript code into form fields. When other users—including administrators or content editors—view the page containing the compromised field, the malicious script executes in their browser. This can lead to credential theft, session hijacking, or unauthorized actions performed on behalf of the victim.

• CVE-2026-47966MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw in form field handling. An attacker with low-level access can inject malicious JavaScript that persists in the application. When other users view the compromised form, the injected script executes in their browsers, potentially allowing credential theft, session hijacking, or further compromise. The vulnerability affects multiple versions through 2026.04 and earlier.

• CVE-2026-47970MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability in form fields that allows attackers with basic user privileges to inject malicious scripts. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially stealing data or performing unauthorized actions. The vulnerability affects multiple AEM versions through 2026.04.

• CVE-2026-47972MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting flaw that allows low-privileged users to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the attacker's script executes in their browsers, potentially compromising sessions, stealing credentials, or performing actions on their behalf. The vulnerability affects multiple AEM versions through 2026.04.

• CVE-2026-47973MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious scripts into form fields. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially stealing credentials, session tokens, or sensitive data. The vulnerability affects multiple versions of AEM, including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47974MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows attackers with low-level user access to inject malicious JavaScript into form fields. When other users view those compromised pages, the malicious code runs in their browsers. This is a scope-change vulnerability, meaning an attacker can potentially affect users beyond their normal permission level. The vulnerability affects multiple recent versions of AEM.

• CVE-2026-47975MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows attackers with basic user privileges to inject malicious scripts into form fields. When legitimate users visit pages containing these compromised fields, the attacker's JavaScript executes in their browsers. This is distinct from reflected XSS because the malicious payload persists in the application's database, affecting all subsequent visitors. The vulnerability requires user interaction—a victim must view the poisoned page—but the attacker needs only low-level access to inject the payload initially.

• CVE-2026-47977MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw in certain form fields. An attacker with low-level system access can embed malicious JavaScript into these fields, and that script executes automatically when other users view the affected page. The vulnerability requires user interaction (victims must visit the page), but the stored nature means the attack persists and affects anyone who accesses the compromised content.

• CVE-2026-47978MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with low-level account privileges to embed malicious scripts into form fields. When legitimate users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially compromising their sessions or stealing sensitive data. This is a *stored* vulnerability, meaning the malicious payload persists in the application until remediated—unlike reflected XSS that requires a crafted link. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04, and earlier.

• CVE-2026-47980MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious scripts. When a victim visits a page containing an affected form field, the injected JavaScript executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim. The vulnerability affects versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47981MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows attackers with basic user privileges to embed malicious code into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47982MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a cross-site scripting (XSS) flaw in versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can craft a malicious webpage that, when visited by an authenticated AEM user, executes arbitrary JavaScript in the user's browser session. The attack manipulates the page's DOM to inject and run hostile code, potentially allowing the attacker to steal session tokens, modify content, or perform actions on behalf of the victim. Because exploitation requires the victim to actively visit a malicious page, this is a lower-risk variant of XSS, but it can still escalate to account compromise or unauthorized modifications within AEM.

• CVE-2026-47983MEDIUM 5.4

  Adobe Experience Manager contains a vulnerability that allows attackers to inject and execute malicious JavaScript code in a victim's browser through specially crafted webpages. The attack requires a user to be logged in (or have an authenticated session) and to visit a malicious link or page, but once that happens, the attacker can steal session data, modify page content, or perform actions on behalf of the victim within the AEM environment. This is a DOM-based XSS vulnerability, meaning the malicious code manipulates how the browser's Document Object Model is rendered rather than relying on unsanitized server-side output.

• CVE-2026-47985MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a vulnerability where attackers can inject malicious JavaScript that runs in a user's browser when they visit a specially crafted webpage. The attack exploits how the application handles dynamic content in the browser's DOM (Document Object Model), allowing an attacker to steal session data, redirect users, or perform actions on their behalf within AEM. This requires the victim to click a link or visit a page—the attacker cannot force exploitation remotely. The vulnerability affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47986MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious JavaScript code into web pages viewed by authenticated users. The vulnerability affects versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker must trick a user into visiting a specially crafted webpage while that user is logged into AEM; the malicious script then executes in the user's browser with their privileges. This can lead to unauthorized actions, data theft, or further compromise depending on the victim's role and permissions.

• CVE-2026-47987MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages. The flaw affects versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the vulnerability. Once executed, the attacker's code runs in the victim's browser with the same privileges as the logged-in user, potentially allowing unauthorized actions or data theft.

• CVE-2026-47989MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw in versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can craft a malicious webpage that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser. This runs within an elevated scope—meaning the attacker gains access to resources and data the victim can access, potentially beyond what a typical reflected XSS would permit. The flaw requires user interaction but poses meaningful risk in multi-tenant or content-collaboration environments where AEM is deployed.

• CVE-2026-47990MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows attackers with basic system access to plant malicious code in form fields. When legitimate users view affected pages, the injected scripts execute in their browsers, potentially compromising sessions, stealing data, or triggering unwanted actions. The vulnerability affects AEM versions 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-47993MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript in a victim's browser. The attack requires the victim to visit a crafted webpage while authenticated to AEM. Because the vulnerability changes the scope of impact, an attacker could potentially affect resources beyond the vulnerable application itself. This is not currently being exploited in the wild according to public threat databases.

• CVE-2026-48250MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based Cross-Site Scripting (XSS) vulnerability that allows attackers to inject and execute malicious JavaScript in a victim's browser. The vulnerability affects multiple AEM versions (6.5.24, LTS SP1, 2026.04 and earlier) and requires an authenticated user to visit a specially crafted webpage. While the attack requires user interaction and authentication, the scope change means the attacker's privileges can impact resources beyond the vulnerable application itself.

• CVE-2026-48251MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a vulnerability that allows attackers to inject malicious scripts into the DOM, which execute in users' browsers. This DOM-based cross-site scripting (XSS) flaw affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04. Exploitation requires an attacker to trick a user into visiting a specially crafted webpage, making it dependent on user interaction. Once the malicious page loads, the attacker's JavaScript runs within the victim's browser session, potentially allowing theft of session tokens, credential capture, or unauthorized actions on behalf of the user.

• CVE-2026-48256MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM-based cross-site scripting (XSS) flaw. An attacker can craft a malicious webpage that, when visited by an authenticated AEM user, executes JavaScript in the victim's browser with their privileges. The attack requires user interaction—specifically, a victim must click a link or visit the attacker's page—but once triggered, the malicious script runs within the AEM session context, potentially allowing unauthorized actions or data theft.

• CVE-2026-48258MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript code in a victim's browser. The vulnerability affects multiple versions of AEM (6.5.24, LTS SP1, 2026.04 and earlier) and requires an authenticated user with low privileges to click a specially crafted link or visit a malicious webpage. While the impact is limited to theft of session data or minor modification of page content visible to the victim, the cross-scope nature of the vulnerability means the malicious script can access resources and functionality beyond the immediate affected component.

• CVE-2026-48264MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based cross-site scripting vulnerability that allows an authenticated attacker to inject malicious JavaScript into a victim's browser session. The vulnerability affects multiple AEM versions up to and including 6.5.24, LTS SP1, and 2026.04. Successful exploitation requires the victim to visit an attacker-crafted webpage while logged into AEM, making social engineering a prerequisite for impact. The vulnerability carries a CVSS score of 5.4 (Medium), reflecting limited scope but meaningful exposure to confidentiality and integrity.

• CVE-2026-48265MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting vulnerability that allows authenticated attackers to inject malicious JavaScript into a victim's browser session. The flaw requires an attacker to trick a user into visiting a specially crafted webpage while logged into AEM, potentially compromising sensitive data or session integrity. Versions 6.5.24, LTS SP1, 2026.04 and earlier are affected.

• CVE-2026-48266MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages. An attacker would need to trick a user into visiting a specially crafted webpage, where the victim's browser would then execute the attacker's code in the context of their AEM session. This could allow the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim. The vulnerability affects multiple versions of AEM, with scope changes that increase the potential impact surface.

• CVE-2026-48268MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript in a victim's browser. The attack requires the victim to visit a specially crafted webpage while authenticated to an affected AEM instance. An attacker exploiting this could steal session tokens, perform unauthorized actions, or deface content—all within the victim's authenticated session context.

• CVE-2026-48271MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious JavaScript into web pages. The vulnerability requires an attacker to trick a user into visiting a specially crafted webpage while logged into AEM. Once triggered, the malicious script executes in the victim's browser with their permissions, potentially allowing session hijacking, credential theft, or unauthorized actions on behalf of the victim. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-48280MEDIUM 5.4

  Adobe Experience Manager contains a cross-site scripting (XSS) flaw that allows an attacker to inject malicious JavaScript into a user's browser session. The vulnerability is triggered when a victim visits a specially crafted webpage while authenticated to the affected AEM instance. Once executed, the injected code runs with the victim's privileges, potentially allowing theft of session data, unauthorized actions on their behalf, or malware distribution. The issue affects multiple AEM versions including 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-48297MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting vulnerability that allows low-privileged users to embed malicious scripts into form fields. When legitimate users view pages containing these compromised fields, the injected JavaScript executes in their browsers, potentially compromising their sessions or enabling further attacks. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-48299MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling. A low-privileged user can inject malicious JavaScript that persists in the system. When other users view the affected form, the injected script executes in their browsers, potentially stealing session data, credentials, or performing actions on their behalf. The vulnerability requires user interaction (viewing the malicious form) to trigger but can affect users across the platform due to its changed scope classification.

• CVE-2026-48300MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious JavaScript. When a victim visits a page containing an affected form field, the attacker's script executes in their browser, potentially compromising their session or stealing sensitive data. The vulnerability affects multiple versions including 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-48301MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows a low-privileged user to plant malicious code in form fields. When other users visit pages containing these compromised fields, the injected scripts execute in their browsers, potentially stealing session data, credentials, or performing actions on their behalf. The vulnerability affects multiple versions through 2026.04 and requires user interaction—a victim must view the poisoned form—but the attacker needs only basic authentication access to inject the payload.

• CVE-2026-48304MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript into form fields. When other users—typically administrators or content editors—view pages containing these compromised fields, the attacker's script executes in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The vulnerability affects multiple versions through 2026.04 and requires user interaction (the victim must view the poisoned form) but can compromise users with higher privileges than the attacker.

• CVE-2026-48559MEDIUM 5.4

  Lightweight Music Server (LMS) version 3.76.0 and earlier contains a stored cross-site scripting (XSS) vulnerability in how it handles media file metadata. An attacker can craft a malicious media file with embedded JavaScript in tags like GENRE, ARTIST, or ALBUM, then introduce it into a victim's music library. When the library is scanned, the payload is permanently stored and automatically executes in the web interface whenever that file's metadata is displayed, potentially allowing unauthorized actions on behalf of the logged-in user.

• CVE-2026-48560MEDIUM 5.4

  Microsoft Office SharePoint contains a deserialization flaw that allows an authenticated user to manipulate data in transit, potentially impersonating other users or altering information within the SharePoint environment. The vulnerability requires valid credentials to exploit, limiting exposure to insider threats or compromised accounts rather than unauthenticated internet attackers. The impact is confined to confidentiality and integrity concerns—no system availability is at risk.

• CVE-2026-5005MEDIUM 5.4

  CVE-2026-5005 is a stored cross-site scripting (XSS) vulnerability in Twiser Informatics Technology Consulting's OKRs & Goals application. An authenticated user can inject malicious JavaScript that persists in the application and executes in the browsers of other users who view the affected content. This allows attackers to steal session tokens, redirect users to phishing sites, or perform actions on behalf of victims without their knowledge.

• CVE-2026-50591MEDIUM 5.4

  Znuny, a popular open-source ticketing and service management platform, contains a stored cross-site scripting (XSS) vulnerability in its user preference settings. An authenticated attacker can inject malicious scripts into their profile preferences, which are then executed in the browsers of other users viewing that profile. This affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3. The vulnerability requires an attacker to have valid login credentials and user interaction (another user must visit the attacker's profile) to trigger the payload.

• CVE-2026-50740MEDIUM 5.4

  Revive Adserver versions 6.0.7 and earlier contain a reflected cross-site scripting (XSS) vulnerability in the zone-include.php script. An authenticated user with low-level privileges can inject malicious code through the refresh parameter of the iFrame invocation tag, which is then executed in the browsers of other users who view affected content. This does not require administrator access, making it accessible to ordinary users within an organization running the platform.

• CVE-2026-50742MEDIUM 5.4

  Revive Adserver 6.0.7 contains a stored cross-site scripting (XSS) vulnerability in two administrative maintenance tools: `maintenance-acl-check.php` and `maintenance-banners-check.php`. When these tools detect inconsistencies in the system, they display entity names without properly escaping them first. This allows an attacker to inject malicious JavaScript that gets stored and executed in an administrator's browser when they use these tools. Execution depends on an admin actually running the maintenance checks, which the attacker cannot directly control.

• CVE-2026-50766MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in Koha Library Management System versions 0 through 25.11. An authenticated staff member with permission to edit item records can inject malicious JavaScript code into the public notes field of library items. When other users view the item details page in the public catalog, this injected script executes in their browsers, potentially compromising their sessions or stealing sensitive information. This is a stored attack, meaning the malicious payload persists in the system until removed.

• CVE-2026-50767MEDIUM 5.4

  Koha Library Management System contains a stored cross-site scripting (XSS) vulnerability in its item type administration interface. An authenticated administrator can inject malicious scripts into the check-in message field, which are then stored and executed in the browsers of other users who view that item type. This is a persistence threat rather than a one-time attack—the malicious script remains embedded until manually removed.

• CVE-2026-50876MEDIUM 5.4

  Deck9 Input version 2.0.1 contains a cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious scripts or HTML into web pages. An attacker with login credentials could craft a specially designed payload that, when viewed by another user, executes arbitrary code in that user's browser session. This could lead to session hijacking, credential theft, or unauthorized actions taken on behalf of the victim.

• CVE-2026-5191MEDIUM 5.4

  The Tiled Gallery Carousel Without JetPack WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 3.1. An attacker with contributor-level access or higher can inject malicious scripts into gallery image titles that will execute in the browsers of anyone viewing the affected page. This is a persistence concern because the malicious code is permanently stored in the site's database.

• CVE-2026-53441MEDIUM 5.4

  Jenkins versions 2.483–2.567 and LTS 2.492.1–2.555.2 contain a stored cross-site scripting (XSS) vulnerability in how they handle user-supplied descriptions for generic offline causes. An attacker with Agent/Configure permissions can inject malicious script into the offline cause description via the POST config.xml API, and that script will execute in the browsers of other users who view the Jenkins interface. This is a classic stored XSS—the payload persists in Jenkins' configuration until removed.

• CVE-2026-53606MEDIUM 5.4

  The sanitize-html library, which removes malicious content from HTML before display, has a configuration flaw that allows JavaScript code injection attacks. When developers configure the library to permit certain HTML attributes (like `action`, `formaction`, `data`, `poster`, `background`, or `ping`), the library fails to block dangerous `javascript:` URIs in those fields. This means attackers can craft HTML that executes JavaScript in a user's browser without the user realizing it—a classic cross-site scripting (XSS) vulnerability. The flaw exists because the library only checks URI safety for a limited set of attributes by default, missing several others defined by the HTML standard. Version 2.17.5 closes this gap.

• CVE-2026-53722MEDIUM 5.4

  Nuxt, a popular Vue.js development framework, contains a cross-site scripting vulnerability in its <NuxtLink> component. The component fails to validate URL schemes in values bound to its `to` or `href` props, allowing attackers to inject malicious javascript: or vbscript: URLs. When a user clicks a link crafted this way, arbitrary JavaScript executes within the application's origin. The vulnerability affects versions before 3.21.7 and 4.4.7. Exploitation requires an attacker to control input that binds to the component—such as query parameters, CMS fields, or user profile URLs—and a user to click the malicious link.

• CVE-2026-53740MEDIUM 5.4

  The Yoast Duplicate Post WordPress plugin through version 4.6 contains a stored cross-site scripting (XSS) vulnerability in its scheduled republish feature. When an administrator views a scheduled republish notice in the Classic Editor, the plugin fails to properly escape the crafted post title and permalink, allowing an attacker with contributor-level access to inject and execute malicious JavaScript. This occurs because the plugin inserts user-controlled content directly into the notice without sanitization.

• CVE-2026-53741MEDIUM 5.4

  Simple Link Directory versions up to 9.0.4 contain a stored cross-site scripting (XSS) vulnerability in the 'sld_no_results_found' option. An authenticated user can inject malicious JavaScript that persists in the application's configuration. When the plugin renders this option on the frontend, the payload breaks out of its intended string context and executes in the browser of every visitor, potentially compromising site visitors' sessions, stealing credentials, or spreading malware.

• CVE-2026-53742MEDIUM 5.4

  Simple Link Directory, a WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 9.0.4. The vulnerability exists in how the embed shortcode feature handles user-supplied attributes—specifically, it fails to properly escape these attributes when writing them into HTML data attributes. An attacker with WordPress contributor-level access can inject malicious JavaScript code through crafted shortcode parameters. When a site visitor views the affected embedded content, the injected script executes in their browser with their privileges, potentially allowing account compromise or malicious actions performed on their behalf.

• CVE-2026-53907MEDIUM 5.4

  MCO (My Compliance Office) contains a stored cross-site scripting vulnerability in its logo upload feature. An authenticated attacker can upload a specially crafted SVG file containing malicious JavaScript that executes when other users view or render the logo. The vulnerability requires user interaction and authenticated access, but once exploited, affects all users who load the compromised logo, making it a persistent threat within the application.

• CVE-2026-53962MEDIUM 5.4

  Discourse, a popular open-source discussion platform, has a vulnerability in how it sanitizes uploaded SVG files and user avatars. An attacker with a user account could craft a malicious SVG that executes JavaScript in the browser when specific non-standard URLs are accessed. This requires user interaction (clicking a link) and only affects visitors to those particular URLs, not the general community experience. The vulnerability has been patched in recent versions across multiple release branches.

• CVE-2026-54025MEDIUM 5.4

  LibreChat, a popular open-source ChatGPT alternative supporting multiple AI providers, contains a stored cross-site scripting (XSS) vulnerability in its markdown artifact preview system. When a user includes an image in a markdown artifact with specially crafted alt text, the application fails to properly escape double-quote characters. An attacker can exploit this to inject malicious JavaScript code that executes in the victim's browser when the preview renders. The flaw exists because LibreChat's custom image renderer defers to a third-party library's default handler under certain conditions, and that handler does not sanitize the alt text before inserting it into HTML attributes. The vulnerability requires user interaction (viewing a preview) and authenticated access, limiting its scope but still posing a meaningful risk to collaborative environments.

• CVE-2026-54301MEDIUM 5.4

  n8n, an open source workflow automation platform, contains a cross-site scripting (XSS) vulnerability in its Respond to Webhook node. An authenticated user with workflow edit permissions can configure the node to serve binary content with a malicious Content-Type header. Because the binary response path bypasses n8n's Content-Security-Policy protections, this allows arbitrary JavaScript to execute in the n8n web application origin—meaning attackers can access the authenticated user's session and credentials when that user visits a specially crafted public webhook URL. The vulnerability requires an authenticated attacker and user interaction, but the damage is confined to the victim's n8n account and the data it can access.

• CVE-2026-54302MEDIUM 5.4

  n8n, a popular open-source workflow automation platform, contains a stored cross-site scripting (XSS) vulnerability in its Chat Trigger feature. An authenticated user with permission to edit workflows can inject malicious JavaScript code by manipulating the webhookId parameter. When another logged-in user visits the generated chat URL, that injected code executes within the n8n application context, giving the attacker access to the victim's session and permissions. The vulnerability requires both authentication and user interaction to exploit, limiting its immediate blast radius but remaining a meaningful risk in multi-tenant or shared n8n deployments.

• CVE-2026-54303MEDIUM 5.4

  n8n, an open source workflow automation platform, contains a reflected cross-site scripting (XSS) vulnerability in its Meta and Microsoft Teams trigger node endpoints. When a logged-in n8n user clicks a specially crafted link, the endpoint reflects unsanitized query parameters directly into the HTTP response. Because the application lacks Content-Security-Policy headers, an attacker's malicious JavaScript executes in the context of the n8n application, potentially allowing session hijacking, credential theft, or unauthorized workflow modifications. The vulnerability affects all versions prior to 2.24.0.

• CVE-2026-54720MEDIUM 5.4

  Silverstripe CMS contains a cross-site scripting (XSS) vulnerability in its media embedding feature. When a CMS user inserts media from the web using a specially crafted embed URL, an attacker can inject malicious code that executes in the user's browser session. This requires user interaction—specifically, a CMS administrator or editor must attempt to embed the attacker's malicious URL—but once triggered, it can compromise the user's CMS credentials or session. The vulnerability affects Silverstripe Framework versions before 6.2.2.

• CVE-2026-55424MEDIUM 5.4

  Discourse forums can be vulnerable to JavaScript injection through topic featured links. If a user with permission to set a featured link on a topic crafts a malicious link, it could execute arbitrary JavaScript in other users' browsers when they view the topic list—but only if the site administrator has modified or disabled Discourse's default Content Security Policy. This is a stored cross-site scripting (XSS) vulnerability that affects multiple Discourse release branches.

• CVE-2026-55437MEDIUM 5.4

  Coder, a platform for provisioning remote development environments, contains a stored cross-site scripting (XSS) vulnerability in its dashboard logging component. When workspace agent logs contain HTML or script code, the dashboard renders this content as live markup rather than displaying it as plain text. An attacker who can control what appears in agent logs can inject malicious scripts that execute in the browser of any user viewing those logs. This requires the attacker to first compromise or control a workspace agent, then trick an administrator or developer into viewing the poisoned logs.

• CVE-2026-56283MEDIUM 5.4

  Capgo versions prior to 12.128.2 contain an HTML injection vulnerability in the organization settings area. An authenticated attacker can inject malicious HTML into the organization name field, potentially redirecting users to fake websites designed for phishing or damaging the organization's reputation. The vulnerability requires user interaction—an administrator or team member must visit the affected settings page—but once triggered, the injected content can affect multiple users viewing that organization's settings.

• CVE-2026-56356MEDIUM 5.4

  n8n's Chat Trigger node has a stored cross-site scripting (XSS) flaw in its Custom CSS field. A workflow creator or editor can inject malicious JavaScript that gets saved in the workflow and executes when anyone visits the public chat page. This affects n8n versions before 1.123.27, versions 2.0.0 through 2.13.2, and version 2.14.0. The vulnerability requires authenticated access to create or modify workflows, so it's limited to users with those permissions, but the actual attack—XSS against chat visitors—happens without further interaction needed from those visitors.

• CVE-2026-56358MEDIUM 5.4

  n8n, a popular workflow automation platform, has a stored cross-site scripting (XSS) vulnerability in its Form Trigger node. Users with permission to create workflows can embed malicious code into form designs that will execute automatically whenever someone visits the form. This affects n8n versions before 1.123.25 (in the 1.x line) and before 2.11.2 (in the 2.x line), with a fix also available in 2.12.0. The vulnerability requires the attacker to already have workflow creation access, limiting the immediate blast radius but creating significant risk for organizations where multiple users can design forms.

• CVE-2026-56359MEDIUM 5.4

  n8n versions prior to 2.8.0 contain a cross-site scripting (XSS) vulnerability in the credential management system. Authenticated users can inject malicious JavaScript into OAuth2 credential fields, specifically the Authorization URL. If a victim clicks the OAuth authorization button while viewing a crafted malicious credential, arbitrary JavaScript executes in their browser with their session privileges. This requires both authentication and user interaction, limiting its scope but creating a meaningful risk in shared or collaborative n8n deployments.

• CVE-2026-58028MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in Wikimedia MediaWiki and CentralAuth that allows authenticated users to inject malicious scripts into web pages. An attacker with login credentials can craft input that, when viewed by other users, executes arbitrary JavaScript in their browsers. This could enable session hijacking, credential theft, or defacement depending on the victim's permissions. The vulnerability spans multiple API and rendering functions within the codebase.

• CVE-2026-58031MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in MediaWiki's API Sandbox interface. An authenticated user can inject malicious scripts that execute in another user's browser when they interact with the sandbox feature. The scripts run in the context of the MediaWiki site, allowing the attacker to steal session tokens, perform actions on behalf of the victim, or redirect them to malicious sites. This requires both user authentication and victim interaction, limiting its scope but still posing a meaningful risk to collaborative wiki environments.

• CVE-2026-58144MEDIUM 5.4

  Cotonti Siena versions 0.9.26 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows authenticated users with file management permissions to inject malicious scripts. By inserting script code into folder titles, attackers can craft payloads that execute in the browsers of other users—including administrators—who view the affected folder listings. The injected scripts remain stored in the database and execute persistently each time the folder is displayed.

• CVE-2026-58402MEDIUM 5.4

  Hugo, a popular static site generator, has a vulnerability in how it renders code blocks in Markdown files. When a developer includes a code fence with a specially crafted language identifier (the part that specifies syntax highlighting, like 'python' or 'javascript'), Hugo fails to properly escape HTML characters. An attacker who can contribute Markdown content—such as through a collaborative documentation project or a compromised content repository—can inject malicious JavaScript that executes in the browsers of anyone viewing the generated website. The vulnerability affects all versions from 0.60.0 through 0.163.2; upgrading to 0.163.3 or later closes the gap.

• CVE-2026-58519MEDIUM 5.4

  The Mediawiki Cargo Extension contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. Once injected, these scripts execute in the browsers of other users who view the affected content, potentially compromising their sessions, stealing credentials, or performing unauthorized actions on their behalf. The vulnerability stems from insufficient input sanitization during web page generation.

• CVE-2026-58524MEDIUM 5.4

  Microsoft Edge (Chromium-based) contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. An attacker can exploit this by crafting a specially designed webpage that, when visited, executes arbitrary JavaScript in the victim's browser context. The vulnerability requires user interaction—specifically clicking a link or visiting a malicious site—but does not require the attacker to be authenticated. Successful exploitation can lead to credential theft, session hijacking, or impersonation of trusted content.

• CVE-2026-58579MEDIUM 5.4

  RAGFlow versions before 0.26.3 contain a stored cross-site scripting (XSS) vulnerability in the agent pipeline editor. When a workspace member with agent creation or editing permissions names a pipeline node, that name is not properly sanitized and is later displayed in a confirmation dialog when other workspace members attempt to rerun a dataflow. If the node name contains malicious JavaScript, that code executes in the victim's browser with their session privileges, potentially allowing the attacker to steal authentication tokens or take over accounts. The vulnerability requires authenticated access and user interaction (clicking rerun), but it crosses trust boundaries within the same workspace.

• CVE-2026-59102MEDIUM 5.4

  Forgejo versions before 15.0.3 have a stored cross-site scripting (XSS) flaw that lets authenticated users inject malicious code into the system. When a user sets their full name to contain HTML or JavaScript, and an Actions workflow run is triggered, other users viewing that run's details page will have the attacker's script execute in their browser. This happens because the system fails to properly escape user-supplied display names when building the run description, and the frontend renders it as raw HTML rather than safe text.

• CVE-2026-60120MEDIUM 5.4

  Bagisto, an open-source e-commerce platform, has a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code into customer accounts. An unauthenticated attacker can register a customer account and embed JavaScript in the first or last name field. When an administrator later views that customer's order creation page, the malicious code executes in their browser with administrator privileges. This can lead to unauthorized actions, session hijacking, or further compromise of the Bagisto admin panel.

• CVE-2026-6283MEDIUM 5.4

  DivvyDrive, a file collaboration platform by DivvyDrive Information Technologies Inc., contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the application. When other users view pages containing this injected content, the malicious script executes in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects versions 4.8.2.23 through 4.8.3.0, and has been patched in version 4.8.3.1.

• CVE-2026-6658MEDIUM 5.4

  Jupyter's nbconvert tool, a widely used utility for converting Jupyter notebooks to other formats including HTML, contains a cross-site scripting (XSS) vulnerability in versions 7.17.0 and earlier. When converting notebooks to HTML, the tool fails to properly sanitize content from Mermaid diagram cells, allowing an attacker who can craft a malicious notebook to inject arbitrary JavaScript code. This code would execute in the browser of anyone viewing the exported HTML file, potentially compromising their session or stealing sensitive information. The attack requires user interaction (opening the exported HTML) and authenticated access to nbconvert, but the impact spreads across security domain boundaries (affecting different sites or applications).

• CVE-2026-7186MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in Checkmk's URL dashboard widget that allows authenticated users with dashboard editing permissions to inject malicious scripts. When other users view an affected dashboard, these scripts execute in their browsers without their knowledge. The vulnerability affects Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions. An attacker needs valid Checkmk credentials and dashboard edit access to exploit this flaw.

• CVE-2026-8309MEDIUM 5.4

  Armiya Information Technologies' Access Control System (GKS) versions before Version 2 contain a reflected cross-site scripting (XSS) vulnerability. An attacker who tricks a logged-in user into clicking a malicious link can inject arbitrary JavaScript code that executes in the victim's browser session, potentially stealing credentials, session tokens, or sensitive information displayed on the page. The vulnerability requires user interaction and a valid login, limiting its attack scope but not eliminating the risk.

• CVE-2026-8315MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in Webbeyaz Web Design Mediküm Web through version 08072026. An authenticated attacker can inject malicious scripts into the application that are stored and later executed in the browsers of other users who view the affected content. This allows the attacker to steal session cookies, redirect users, or perform actions on their behalf. Importantly, the vendor has confirmed this product is no longer supported, meaning patches are unlikely to be released.

• CVE-2026-8833MEDIUM 5.4

  Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases contain a flaw in how they validate URLs. An authenticated attacker can craft a malicious link using HTML encoding tricks to bypass the validation system and inject harmful URLs—such as javascript: links—into the application. When another user clicks or interacts with the crafted link, it can execute arbitrary JavaScript in their browser, compromising their session and data.

• CVE-2026-9308MEDIUM 5.4

  Firefox for iOS Reader View had a template injection vulnerability where malicious web pages could exploit the order of placeholder substitution to inject JavaScript. When the app converted page content into Reader View, it processed user-controlled content before handling internal JSON-LD data placeholders. An attacker could craft a webpage with a specially-formatted string that, after substitution, becomes executable JavaScript code. This requires user interaction—the victim must open the malicious page and enable Reader View.

• CVE-2026-9309MEDIUM 5.4

  Firefox for iOS Reader View had a vulnerability that failed to properly sanitize HTML tags embedded in JSON-LD metadata on web pages. An attacker could craft a malicious website that injects markup into Reader View, disrupting its normal behavior and extracting sensitive URL parameters—such as authentication tokens or session identifiers—that users might not realize were being exposed. In certain scenarios, this could allow an attacker to redirect those parameters toward internal endpoints, potentially enabling arbitrary JavaScript execution within a privileged origin. Mozilla fixed this issue in Firefox for iOS version 151.2.

• CVE-2026-9811MEDIUM 5.4

  Mautic 7 contains a stored cross-site scripting (XSS) flaw in its project selector component. An authenticated user with project creation permissions can inject malicious JavaScript into a project name. When an admin later opens an entity editor that displays that project in a dropdown, the script runs in the admin's browser—potentially allowing the attacker to steal sessions, manipulate data, or access sensitive dashboard information. The vulnerability requires user interaction (admin opening the editor) and valid authentication to exploit, making it a medium-risk issue that is not currently tracked as actively exploited in the wild.

• CVE-2026-9971MEDIUM 5.4

  A vulnerability in Google Chrome on iOS allows attackers to inject malicious scripts or HTML code into web pages when a user performs specific interactions with the browser. An attacker would need to craft a deceptive webpage and convince a user to engage with it in particular ways—such as specific taps or gestures—to trigger the injection. Once successful, the attacker gains the ability to run arbitrary code in the context of the webpage, potentially stealing data or modifying what the user sees.

• CVE-2026-8474MEDIUM 5.3

  A reflected cross-site scripting (XSS) vulnerability exists in the login API of Stormshield Network Security (SNS) appliances. An attacker can craft a malicious link or inject code that, when accessed by a user, executes arbitrary JavaScript in their browser. This could allow theft of session cookies, capture of credentials, or redirection to phishing sites. The vulnerability affects versions 4.3.0–4.3.41, 4.8.0–4.8.15, and 5.0.0–5.0.5.

• CVE-2026-43979MEDIUM 5.0

  Local Deep Research versions before 1.6.0 contain a vulnerability where user-supplied search queries and metadata are inserted directly into HTML without proper escaping before being converted to PDF. An authenticated user can inject HTML tags that trick the server into making unauthorized web requests (SSRF), bypassing existing security controls. The vulnerability requires valid credentials but poses moderate risk due to potential confidentiality impact.

• CVE-2026-57439MEDIUM 5.0

  CyberChef, a popular web application for data encryption, encoding, and analysis, contains a vulnerability in its Series Chart operation that allows an attacker to inject malicious code. By crafting a specially formatted CSV file with a `__proto__` key, an attacker can exploit prototype pollution—a JavaScript technique that modifies object prototypes—to insert harmful JavaScript that gets executed when the data is rendered in HTML. This requires user interaction (opening/uploading a file) but can compromise the security of the application and potentially affect downstream operations like UDP packet parsing.

• CVE-2026-0266MEDIUM 4.8

  A stored cross-site scripting (XSS) vulnerability exists in Palo Alto Networks PAN-OS that allows an authenticated administrator to inject malicious JavaScript into the web interface. The payload persists in the system and executes when other users access the affected interface, potentially compromising their sessions or stealing sensitive data. The vulnerability requires valid administrator credentials to exploit, which significantly limits the attack surface but remains a genuine concern for insider threats or compromised admin accounts.

• CVE-2026-10057MEDIUM 4.8

  ITS Intelligent SCADA System contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with elevated privileges to inject malicious JavaScript code into the application. Once injected, this code persists in the system and executes automatically whenever other users load affected pages in their browsers. This is distinct from reflected XSS because the payload remains embedded in the application, posing a sustained risk to all users who access the compromised content.

• CVE-2026-10058MEDIUM 4.8

  ITS Intelligent SCADA System contains a stored cross-site scripting (XSS) flaw that lets high-privilege attackers inject malicious JavaScript into the system. When other users load affected pages, that injected code runs in their browsers automatically. This is a persistence threat—the malicious script stays in the system until removed, affecting anyone who accesses the compromised page.

• CVE-2026-13373MEDIUM 4.8

  WatchGuard Fireware OS contains a stored cross-site scripting (XSS) vulnerability in its Tigerpaw Technology Integration module. An attacker with high privilege access can inject malicious scripts that remain permanently stored in the system and execute when other users view affected pages. This is a secondary exploitation path related to CVE-2025-13936. The vulnerability requires user interaction to trigger and affects a wide range of WatchGuard Firebox appliances and FireboxCloud/FireboxV platforms.

• CVE-2026-13374MEDIUM 4.8

  WatchGuard's Fireware operating system contains a stored cross-site scripting (XSS) vulnerability in the ConnectWise Technology Integration module. An attacker with high-level administrative privileges can inject malicious scripts that persist in the system and execute in the browsers of other users who view affected pages. This is a secondary attack path related to the previously disclosed CVE-2025-13937. The vulnerability requires user interaction to trigger and affects the confidentiality and integrity of data visible to victims, but does not impact system availability.

• CVE-2026-13375MEDIUM 4.8

  WatchGuard Fireware OS contains a stored cross-site scripting (XSS) vulnerability in its Autotask Technology Integration module. An authenticated attacker with high privileges can inject malicious scripts that remain in the system and execute in the browsers of other users who interact with affected pages. This is a secondary attack vector for an earlier vulnerability (CVE-2025-13938). The vulnerability requires administrator-level access and user interaction to exploit, limiting immediate risk but warranting attention in environments with untrusted or compromised admin accounts.

• CVE-2026-13376MEDIUM 4.8

  WatchGuard's Fireware OS contains a stored cross-site scripting (XSS) vulnerability in the spamBlocker module that allows authenticated attackers to inject malicious scripts into web pages. Because the payload is stored, any user accessing the affected page will execute the attacker's code in their browser. This is a secondary attack path related to the previously disclosed CVE-2025-1071 and requires administrative privilege to exploit, but once injected, affects all viewers of the compromised content.