By severity

Medium-severity vulnerabilities

CVEs rated Medium by CVSS, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 25 of 41

• CVE-2026-36162MEDIUM 5.4

  LiquidFiles v4.2.7 contains a vulnerability that allows authenticated users to inject malicious code into file share names. When other users view these crafted shares, the malicious code executes in their browsers, potentially allowing the attacker to steal session data, redirect users, or perform actions on their behalf. The attacker must already have valid credentials to exploit this, and a victim must interact with the poisoned share for the attack to succeed.

• CVE-2026-36163MEDIUM 5.4

  LiquidFiles v4.2.7 contains a stored HTML injection flaw in its file viewing feature. When an authenticated user uploads a crafted HTML file, the application fails to properly sanitize or escape the content before displaying it to other users. This allows an attacker to embed malicious JavaScript that executes in victims' browsers, potentially stealing session tokens, redirecting users, or performing actions on their behalf within the LiquidFiles interface.

• CVE-2026-36722MEDIUM 5.4

  Bookcars v8.3 contains a file upload vulnerability in its car image creation API that allows authenticated users to upload specially crafted files and potentially execute arbitrary code on the server. An attacker with valid credentials can exploit this weakness to compromise the application and potentially gain control of the underlying system.

• CVE-2026-36728MEDIUM 5.4

  FastapiAdmin version 2.2.0 contains a stored cross-site scripting (XSS) vulnerability in its AI assistant chat feature. An authenticated attacker can inject malicious JavaScript or HTML through a crafted chat message. When other users view the message, the malicious script executes in their browser with access to their session and sensitive data. This requires an attacker with valid login credentials and victim user interaction (viewing the chat), limiting but not eliminating real-world risk.

• CVE-2026-38979MEDIUM 5.4

  Ajenti, a system administration interface, fails to protect its login and administrative panels from clickjacking attacks. An attacker can craft a webpage that tricks users into unknowingly interacting with hidden Ajenti UI elements, potentially leading to unauthorized actions or credential harvesting. The vulnerability exists because Ajenti does not add browser-level framing protections to its responses.

• CVE-2026-40082MEDIUM 5.4

  Cacti, a widely-deployed open source monitoring and management framework, contains a session fixation vulnerability in its login process. When users authenticate, the application fails to rotate the session identifier, allowing an attacker to potentially hijack authenticated sessions through same-site attack vectors. The flaw exists in versions 1.2.30 and earlier; version 1.2.31 and later address it. While the session cookie itself is well-configured with security flags (httpOnly, Strict SameSite, secure for HTTPS), the missing session ID regeneration leaves a window for exploitation during the critical authentication moment.

• CVE-2026-40930MEDIUM 5.4

  A parsing flaw in libpng 1.8.0's APNG (Animated PNG) handler can cause specially crafted image data to be misinterpreted. When the parser encounters certain frame chunks in an APNG file, it clears internal state flags but fails to skip over the actual chunk data and checksum. On the next data processing call, bytes from the ignored chunk can masquerade as a new chunk header, potentially leading to integrity violations or denial of service. An attacker needs user interaction—typically opening a malicious PNG file—to trigger the issue.

• CVE-2026-40995MEDIUM 5.4

  Spring Web Services has a vulnerability in its X509 certificate authentication handler that bypasses Spring Security's standard account status checks. When a user presents a valid certificate that maps to a known user account, the system authenticates them without verifying whether that account is disabled, locked, expired, or has expired credentials. This means someone with a legitimate certificate could gain access even if their account should be inactive.

• CVE-2026-41479MEDIUM 5.4

  Authlib, a popular Python library for building OAuth and OpenID Connect servers, contains an open redirect vulnerability in its authorization endpoint. When an attacker sends a specially crafted request with an unsupported response type and a malicious redirect URL, the server redirects users to that attacker-controlled site without proper validation. This happens before the system even checks if the client is legitimate or if the user is logged in, meaning an attacker needs no prior setup—just a single request can redirect an unsuspecting user elsewhere. The flaw affects versions before 1.6.10 and 1.7.1.

• CVE-2026-41972MEDIUM 5.4

  CVE-2026-41972 is a path traversal vulnerability in an SMS application that could allow an attacker to manipulate file paths and disrupt service availability. The vulnerability requires user interaction (such as clicking a malicious link) but does not require authentication, making it accessible to remote attackers. While the flaw does not compromise confidentiality or enable data theft, it can degrade or interrupt the SMS app's normal operation.

• CVE-2026-42547MEDIUM 5.4

  IRIS, a web platform used by incident response teams to collaborate and share investigation details, contains an authorization flaw in versions before 2.4.28 that allows users to create alerts falsely attributed to customers they don't manage. When combined with cross-site scripting vulnerabilities, attackers can also steal alerts belonging to other customers. This means a low-privileged user could pollute another team's alert stream with fraudulent incidents or harvest sensitive investigation data.

• CVE-2026-42951MEDIUM 5.4

  A vulnerability in Danelec MacGregor Voyage Data Recorder (VDR) devices allows authenticated users to download a complete backup file that exposes sensitive account credentials and password hashes. While an attacker must already have valid user credentials to exploit this issue, successful exploitation grants access to password material that could enable lateral movement or privilege escalation within maritime network environments. The vulnerability is classified as medium severity due to the authentication requirement, though the disclosure of password hashes represents a meaningful step toward further compromise.

• CVE-2026-43915MEDIUM 5.4

  Coturn, an open-source TURN/STUN server implementation, contains a stored cross-site scripting (XSS) flaw in its web administration interface. An attacker can inject malicious HTML or JavaScript through a crafted username when creating a TURN allocation. When an authenticated administrator views the session list, the injected code executes in their browser, potentially allowing session hijacking, credential theft, or administrative takeover. The vulnerability is particularly concerning in deployments using anonymous access mode, where no TURN credentials are required for exploitation. Version 4.11.0 and later resolve this issue.

• CVE-2026-44311MEDIUM 5.4

  Fabric.js, a popular JavaScript library for working with HTML5 canvas, contains a Cross-Site Scripting (XSS) vulnerability in versions before 7.4.0. The issue stems from improper handling of user input when converting gradient objects to SVG format. Specifically, when the toSVG() method processes color values in gradient color stops, it fails to escape special characters. If a web application takes the generated SVG string and inserts it into a webpage, an attacker can craft malicious input that executes arbitrary JavaScript in users' browsers. The vulnerability requires user interaction and affects the integrity and confidentiality of the browser session.

• CVE-2026-44611MEDIUM 5.4

  Danelec MacGregor's Voyage Data Recorder (VDR) uses a weak password hashing method that restricts password length and is vulnerable to brute force attacks. An authenticated attacker with local network access could potentially crack stored passwords to gain unauthorized access to the device or escalate privileges. This is a medium-severity issue affecting maritime safety and navigation systems.

• CVE-2026-44727MEDIUM 5.4

  Jupyter Server versions before 2.20 contain a stored cross-site scripting (XSS) vulnerability in the notebook conversion feature. When a user opens a malicious notebook through the web interface, specially crafted HTML content in the notebook can execute arbitrary JavaScript in the browser with access to session cookies and the Jupyter API. An attacker who can get a user to open a prepared notebook—either by hosting it or tricking them into uploading it—can steal credentials, modify notebooks, or execute code on the Jupyter kernel itself. The vulnerability requires user interaction (opening the notebook) and authenticated access to Jupyter, which limits the immediate blast radius but poses significant risk in multi-user or shared research environments.

• CVE-2026-44783MEDIUM 5.4

  Discourse, a popular open-source discussion platform, contains a flaw in how it handles replies to whisper posts. The vulnerability allows authenticated users who are not members of groups configured to access whispers to inject messages into staff-only whisper channels. This means someone with a regular user account could post messages that appear alongside legitimate staff whispers, potentially disrupting internal conversations or spreading misinformation among staff members. The vulnerability affects versions released between early 2026 and April 2026, and has been patched in all active release branches.

• CVE-2026-44794MEDIUM 5.4

  Nautobot, a network automation platform, contains a permission bypass vulnerability in its REST API that affects how it validates references between database objects. When users create or update records that link to other objects in the system, the API fails to properly check whether the user has permission to view those referenced objects. This means an authenticated user could potentially reference objects they shouldn't have access to, leading to information disclosure or unintended modifications. The issue affects Nautobot versions before 2.4.33 and 3.1.2.

• CVE-2026-44958MEDIUM 5.4

  Revive Adserver versions 6.0.6 and earlier contain a flaw that allows advertiser-level users to toggle banner advertisements on and off without proper authorization. An attacker with basic advertiser credentials can activate or deactivate banners belonging to other accounts or campaigns, disrupting ad delivery even if they lack permission to make such changes. The vulnerability stems from inadequate permission checks in the banner management interface.

• CVE-2026-45023MEDIUM 5.4

  AutoGPT versions before 0.6.59 contain a flaw in their API implementation that allows authenticated users to execute workflow blocks without consuming credits from their account balance. The vulnerability stems from an API endpoint that bypasses the credit-checking logic present elsewhere in the system, enabling users to run unlimited blocks at no cost. This is a business model violation rather than a critical system compromise, but it undermines the platform's monetization and resource management controls.

• CVE-2026-45453MEDIUM 5.4

  CVE-2026-45453 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. When a user visits a compromised page, the attacker's script executes in their browser, enabling spoofing attacks—such as stealing credentials, impersonating legitimate content, or redirecting users to phishing sites. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted URL) but does not require authentication to exploit.

• CVE-2026-45464MEDIUM 5.4

  CVE-2026-45464 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. An attacker can trick users into visiting a crafted SharePoint page, causing their browser to execute the injected code. This enables spoofing attacks where legitimate content or UI elements can be forged to deceive users into divulging credentials, transferring funds, or trusting false information. The vulnerability requires user interaction—a person must click a malicious link or visit a compromised page—but the attacker does not need authentication to craft the attack.

• CVE-2026-45465MEDIUM 5.4

  CVE-2026-45465 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an attacker to inject malicious code into web pages generated by the application. When a user visits a compromised page, the injected script executes in their browser, potentially stealing session tokens, credentials, or performing actions on behalf of the victim. The vulnerability requires user interaction—someone must click a malicious link or visit a booby-trapped SharePoint page—but no special privileges are needed to launch the attack. This is a spoofing risk, meaning attackers could impersonate legitimate SharePoint content or trusted users.

• CVE-2026-45488MEDIUM 5.4

  Microsoft Edge (Chromium-based) contains a user interface flaw that allows attackers to misrepresent critical information to users, potentially tricking them into believing they are interacting with a legitimate website or service when they are not. An attacker can exploit this over the network by manipulating what Edge displays, leading to spoofing attacks. The vulnerability requires user interaction—specifically, the user must take an action in the browser—but does not require special privileges or complex setup to attempt. Impact is limited to partial information disclosure and integrity issues; system availability is not affected.

• CVE-2026-45580MEDIUM 5.4

  WWBN AVideo, an open-source video streaming platform, contains a stored cross-site scripting (XSS) vulnerability in its Live plugin. A user with streaming permissions can inject malicious JavaScript into the stream configuration, which then executes in the browsers of anyone—logged-in or anonymous—who views that live stream. The vulnerability persists because user-controlled input (the stream key) is inserted directly into an HTML class attribute without proper sanitization.

• CVE-2026-45595MEDIUM 5.4

  Windows Mark of the Web (MOTW) is a security feature that warns users when they open files downloaded from the internet. CVE-2026-45595 is a flaw that allows attackers to bypass this warning through network-based attacks. An attacker could craft a malicious file that appears safe to the operating system, potentially tricking users into executing it without the usual security prompts. While the vulnerability requires user interaction to be exploited, it undermines a foundational defense mechanism in Windows.

• CVE-2026-45660MEDIUM 5.4

  Statamic is a content management system built on Laravel that includes an image proxy feature called Glide. A flaw in how this proxy validates URLs allows attackers to bypass security checks by using alternate IP address formats that aren't properly normalized before validation. An unauthenticated attacker could exploit this to make the server fetch content from internal addresses—such as localhost, private networks, or cloud metadata services—potentially exposing sensitive information. The vulnerability only affects Statamic versions before 5.73.22 and 6.18.1, and does not impact deployments running PHP 8.3 or later.

• CVE-2026-45669MEDIUM 5.4

  Nuxt, a popular Vue.js web framework, has a vulnerability in its navigateTo() function when used with the external flag. If an application directs a user to an attacker-controlled URL using this function, the framework generates a server-side redirect page with insufficient sanitization. An attacker can inject malicious HTML and JavaScript into that redirect page, which then executes in the user's browser under the application's origin. This could allow session hijacking, credential theft, or malware distribution. The issue affects Nuxt versions 3.4.3 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5.

• CVE-2026-45670MEDIUM 5.4

  Nuxt, a popular Vue.js framework, contains a security gap in its development server configuration. When developers run the dev server on a non-loopback address (such as making it accessible from other machines on the network), and a developer visits a malicious website while that server is running, an attacker on the same network could potentially steal the developer's source code. This is a regression—an incomplete fix for a previously identified issue. The vulnerability affects versions 3.15.4 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5; patched versions 3.21.6 and 4.4.6 are now available.

• CVE-2026-45692MEDIUM 5.4

  Caddy, a popular open-source web server known for automatic HTTPS, contains a path traversal vulnerability affecting versions 2.4.0 through 2.11.2. The vulnerability arises from a disagreement between two critical layers: the authorization system checks permissions using simple text matching, while the configuration API parses the same paths using numerical array indexing. An attacker with valid credentials can exploit this mismatch to access configuration objects they shouldn't be able to reach. For example, a user authorized to view `/config/servers/0` might be able to access `/config/servers/1` by manipulating how indices are parsed. The flaw requires authentication, so it primarily affects scenarios where multiple users or services share a Caddy instance.

• CVE-2026-45778MEDIUM 5.4

  OpenXDMoD, an open-source HPC (High Performance Computing) metrics collection and analysis framework, contains a stored cross-site scripting (XSS) vulnerability in user profiles combined with a password reset abuse vector. An authenticated attacker can inject malicious JavaScript into their profile, then weaponize the password reset feature to send victims a crafted link. When a victim clicks the link, the attacker's payload executes in their browser, enabling credential theft and account hijacking. All versions prior to 11.0.3 are affected.

• CVE-2026-46342MEDIUM 5.4

  Nuxt, a popular Vue.js framework, contains a vulnerability in its island component rendering system that allows attackers to manipulate server responses by crafting malicious requests. The vulnerability exists because the framework computes a security hash client-side but never validates it server-side, meaning an attacker can request the same endpoint with different parameters and receive unintended responses. This could enable attackers to conduct XSS attacks or retrieve sensitive information if islands expose data meant for other users. The issue affects Nuxt 3.1.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the associated @nuxt/nitro-server package.

• CVE-2026-46448MEDIUM 5.4

  OpenStack Nova before version 33.0.2 has a flaw in its server creation API that fails to properly clean up certain hint data sent during instance creation. This results in newly created instances lacking proper Placement allocation, which tracks where compute resources are assigned in the cloud. The vulnerability requires authenticated access but can lead to partial information disclosure and service availability impact.

• CVE-2026-46546MEDIUM 5.4

  Frappe Learning Management System prior to version 2.53.0 contains a vulnerability where authenticated users can inject malicious code into certain editable fields. When these fields are displayed in page metadata, visiting users' browsers are automatically redirected to attacker-controlled URLs without their knowledge. The vulnerability requires an attacker to have valid user credentials and for a victim to visit a page containing the injected content, but once triggered, it can lead to credential theft, malware distribution, or other social engineering attacks.

• CVE-2026-46550MEDIUM 5.4

  NocoDB, a popular open-source database platform that presents data in a spreadsheet-like interface, contains a cookie security misconfiguration in versions prior to 2026.04.1. The refresh token used to maintain user sessions is vulnerable to interception and cross-site request forgery (CSRF) attacks. An attacker on an unencrypted network could capture the token, or trick a logged-in user into performing an action that unknowingly refreshes their token on an attacker-controlled site. While the cookie was marked httpOnly to prevent JavaScript access, the absence of the secure flag and sameSite attribute creates a meaningful window of exposure.

• CVE-2026-46616MEDIUM 5.4

  Umbraco CMS contains an open-redirect vulnerability in member-related Surface Controllers that fail to properly validate redirect URLs. When a Razor template uses user-controlled query parameters to set a redirect destination, an attacker can craft a malicious link that redirects users to an external site after they interact with the application. This undermines user trust and can be leveraged in phishing campaigns. Versions 13.14.0 and 17.4.0 and later address this issue.

• CVE-2026-47106MEDIUM 5.4

  Ellucian Banner Self-Service contains a stored cross-site scripting (XSS) vulnerability in its course search feature. An authenticated user with write access to the Banner ERP system can inject malicious code into faculty names, email addresses, course descriptions, or course titles. When other users later view course meeting times through an unauthenticated API endpoint, that malicious code executes in their browsers without any sanitization, potentially compromising their sessions or stealing sensitive information. The vulnerability affects all versions released before April 23, 2025.

• CVE-2026-47222MEDIUM 5.4

  NanaZip, a Windows-native variant of the 7-Zip compression utility, contains a flaw in how it processes Android Verified Boot (AVB) image files. When opening a specially crafted .avb or .img file, an arithmetic error in the parser allows an attacker to trigger a crash by causing the application to read far beyond safe memory boundaries. This denial-of-service vulnerability affects NanaZip versions 3.0.1000.0 through 5.x, and has been resolved in version 6.0.1698.0 and newer.

• CVE-2026-47223MEDIUM 5.4

  NanaZip, a modern Windows adaptation of the 7-Zip archive utility, contains a flaw in how it handles specially crafted Android Verified Boot (AVB) vbmeta image files. Versions 3.0.1000.0 through 6.0.1698.0 are vulnerable to a heap memory read error triggered by a malformed salt field in vbmeta headers. An attacker can craft a malicious vbmeta image that, when opened in NanaZip, causes the application to read far beyond allocated memory—potentially exposing sensitive data from the process heap or crashing the application. The vulnerability requires user interaction (opening a file) but does not require special privileges.

• CVE-2026-47636MEDIUM 5.4

  CVE-2026-47636 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. When a user visits a specially crafted SharePoint page, the injected code executes in their browser with their privileges, enabling attackers to impersonate users, steal session data, or perform actions on their behalf. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require authentication to exploit.

• CVE-2026-47639MEDIUM 5.4

  CVE-2026-47639 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an attacker to inject malicious scripts into web pages. When a user visits a compromised page, the attacker's script executes in their browser, potentially stealing credentials, session tokens, or sensitive data, or redirecting users to fraudulent sites. Exploitation requires user interaction—the victim must click a link or visit a crafted page—but no authentication is needed from the attacker's side.

• CVE-2026-47694MEDIUM 5.4

  WWBN AVideo, an open-source video platform, contains a stored cross-site scripting (XSS) vulnerability in how it handles category descriptions. Any user with permission to create or modify video categories can inject malicious JavaScript code into the description field. This code then executes in the browsers of other users who view that category's gallery page. Unlike previously patched XSS issues affecting video titles or comments, this flaw specifically targets the category description rendering pipeline.

• CVE-2026-4772MEDIUM 5.4

  TR7 Cyber Defense Inc.'s WAF-ASP product contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. An attacker with login credentials can craft a request that causes the WAF-ASP system to store and later serve malicious JavaScript to other users, potentially compromising their sessions, stealing credentials, or performing actions on their behalf. This is a stored variant of XSS, meaning the attack persists in the system rather than requiring each victim to click a malicious link.

• CVE-2026-47935MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw that allows an attacker to inject malicious JavaScript code into a victim's browser session. The vulnerability affects multiple versions up to 6.5.24, LTS SP1, and 2026.04. An attacker must trick a user into visiting a specially crafted webpage to trigger the exploit, but once executed, the malicious script runs with the victim's privileges and can access or modify sensitive data within the AEM application context across different origin boundaries.

• CVE-2026-47936MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with basic user permissions to embed malicious code into form fields. When other users view those pages, the attacker's JavaScript runs in their browsers. This is particularly concerning because the injected script can affect other domains or applications (indicated by the changed scope), potentially compromising session tokens or sensitive data from multiple contexts.

• CVE-2026-47939MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers. This is a persistence threat—the malicious payload remains in the system until remediated, affecting anyone who accesses the affected content.

• CVE-2026-47941MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. A low-privileged user can inject malicious JavaScript that persists in the application and executes in other users' browsers when they view the affected page. This is a persistence problem: the attack code lives in the application, not just in a URL or temporary input. The scope change means the XSS can affect resources beyond the vulnerable component itself.

• CVE-2026-47942MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with low-level user access to embed malicious scripts into form fields. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers. This represents a medium-severity risk because it requires both initial low-privileged access and user interaction, but affects multiple versions of a widely-deployed content management platform.

• CVE-2026-47943MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting vulnerability affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A user with low-level permissions can inject malicious JavaScript code into form fields, which then executes when other users view the affected page. This is particularly risky because the malicious payload persists in the system rather than being temporary, and it affects the security boundary between different parts of the application (indicated by the scope change in the CVSS vector). The attack requires user interaction—victims must browse to the page containing the injected field—but the damage is real: attackers can steal session tokens, capture credentials, or perform unauthorized actions on behalf of victims.

• CVE-2026-47944MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript code into form fields. When other users view pages containing these compromised fields, the attacker's scripts execute in their browsers. This is a persistence issue—the malicious payload remains in the system until removed, affecting anyone who accesses the affected content.

• CVE-2026-47945MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with low-level account access to inject malicious JavaScript into form fields. When legitimate users view pages containing these compromised fields, the malicious script executes in their browsers, potentially compromising their sessions, stealing credentials, or performing unauthorized actions on their behalf. The vulnerability affects multiple versions of AEM through version 2026.04 and earlier LTS releases.

• CVE-2026-47946MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based Cross-Site Scripting vulnerability that allows an attacker to inject malicious JavaScript code into a victim's browser session. The attack requires a logged-in user to visit a specially crafted webpage, at which point the attacker's script executes with the victim's privileges within the AEM application context. This can lead to unauthorized actions, data theft, or session hijacking depending on the victim's role and permissions.

• CVE-2026-47947MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw that allows attackers to inject malicious JavaScript into web pages viewed by authenticated users. The vulnerability affects multiple AEM versions through 6.5.24, LTS SP1, and 2026.04. Successful exploitation requires convincing a user to visit an attacker-controlled or compromised webpage while logged into an affected AEM instance. The attacker's code would then execute with the victim's privileges, potentially stealing session data, modifying content, or performing actions on their behalf.

• CVE-2026-47948MEDIUM 5.4

  Adobe Experience Manager versions up to 6.5.24, LTS SP1, and 2026.04 contain a stored cross-site scripting (XSS) flaw that allows attackers with low-level account access to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the attacker's scripts execute in their browsers, potentially allowing credential theft, session hijacking, or other client-side attacks. The vulnerability requires user interaction (viewing the affected page) and a valid login, but can impact users across different security contexts.

• CVE-2026-47949MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability in form fields that allows attackers with basic user privileges to inject malicious JavaScript. When legitimate users view pages containing these compromised fields, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability affects AEM 6.5.24, LTS SP1, 2026.04, and earlier versions.

• CVE-2026-47950MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) flaw that allows low-privileged users to embed malicious scripts into form fields. When other users view pages containing these compromised fields, the attacker's JavaScript runs in their browsers with the victim's permissions. The vulnerability affects multiple AEM versions including 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47951MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability that allows attackers with low-level account privileges to embed malicious code into form fields. When other users visit pages containing these compromised fields, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects multiple AEM versions up to and including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47953MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious scripts. When a victim visits a page containing an affected form field, the injected script executes in their browser with the victim's privileges, potentially compromising their session or stealing sensitive data. The vulnerability affects multiple versions of AEM through 2026.04 and requires authenticated access to exploit, limiting but not eliminating the attack surface.

• CVE-2026-47954MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with basic user privileges to embed malicious code into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers, potentially allowing the attacker to steal credentials, session tokens, or perform actions on behalf of the victim. The vulnerability affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47956MEDIUM 5.4

  Adobe Experience Manager versions through 6.5.24, LTS SP1, and 2026.04 contain a stored cross-site scripting (XSS) flaw in form field handling. An attacker with basic user privileges can inject malicious JavaScript into vulnerable fields. When legitimate users view pages containing these fields, the injected scripts execute in their browsers. This is particularly concerning because the vulnerability changes scope—meaning an attacker could potentially affect other users or system functionality beyond the immediate form context.

• CVE-2026-47957MEDIUM 5.4

  Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. An attacker with low-level system access can inject malicious JavaScript that persists in the application and executes whenever a user views the affected page, potentially allowing credential theft, session hijacking, or malware distribution. The vulnerability requires user interaction—a victim must navigate to the compromised form—but the attacker does not need elevated privileges to introduce the payload.

• CVE-2026-47958MEDIUM 5.4

  Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. A low-privileged user can inject malicious JavaScript that persists in the application and executes when other users view the affected page. Because the vulnerability has a changed scope—meaning the impact crosses trust boundaries—it affects not just the immediate application but potentially other parts of the system or connected domains.

• CVE-2026-47962MEDIUM 5.4

  Adobe Experience Manager is vulnerable to a stored cross-site scripting (XSS) attack where a low-privileged user can inject malicious JavaScript code into form fields. When other users—including administrators or content editors—view the page containing the compromised field, the malicious script executes in their browser. This can lead to credential theft, session hijacking, or unauthorized actions performed on behalf of the victim.

• CVE-2026-47966MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw in form field handling. An attacker with low-level access can inject malicious JavaScript that persists in the application. When other users view the compromised form, the injected script executes in their browsers, potentially allowing credential theft, session hijacking, or further compromise. The vulnerability affects multiple versions through 2026.04 and earlier.

• CVE-2026-47970MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability in form fields that allows attackers with basic user privileges to inject malicious scripts. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially stealing data or performing unauthorized actions. The vulnerability affects multiple AEM versions through 2026.04.

• CVE-2026-47972MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting flaw that allows low-privileged users to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the attacker's script executes in their browsers, potentially compromising sessions, stealing credentials, or performing actions on their behalf. The vulnerability affects multiple AEM versions through 2026.04.

• CVE-2026-47973MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious scripts into form fields. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially stealing credentials, session tokens, or sensitive data. The vulnerability affects multiple versions of AEM, including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47974MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows attackers with low-level user access to inject malicious JavaScript into form fields. When other users view those compromised pages, the malicious code runs in their browsers. This is a scope-change vulnerability, meaning an attacker can potentially affect users beyond their normal permission level. The vulnerability affects multiple recent versions of AEM.

• CVE-2026-47975MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows attackers with basic user privileges to inject malicious scripts into form fields. When legitimate users visit pages containing these compromised fields, the attacker's JavaScript executes in their browsers. This is distinct from reflected XSS because the malicious payload persists in the application's database, affecting all subsequent visitors. The vulnerability requires user interaction—a victim must view the poisoned page—but the attacker needs only low-level access to inject the payload initially.

• CVE-2026-47977MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw in certain form fields. An attacker with low-level system access can embed malicious JavaScript into these fields, and that script executes automatically when other users view the affected page. The vulnerability requires user interaction (victims must visit the page), but the stored nature means the attack persists and affects anyone who accesses the compromised content.

• CVE-2026-47978MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with low-level account privileges to embed malicious scripts into form fields. When legitimate users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially compromising their sessions or stealing sensitive data. This is a *stored* vulnerability, meaning the malicious payload persists in the application until remediated—unlike reflected XSS that requires a crafted link. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04, and earlier.

• CVE-2026-47980MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious scripts. When a victim visits a page containing an affected form field, the injected JavaScript executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim. The vulnerability affects versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47981MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows attackers with basic user privileges to embed malicious code into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47982MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a cross-site scripting (XSS) flaw in versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can craft a malicious webpage that, when visited by an authenticated AEM user, executes arbitrary JavaScript in the user's browser session. The attack manipulates the page's DOM to inject and run hostile code, potentially allowing the attacker to steal session tokens, modify content, or perform actions on behalf of the victim. Because exploitation requires the victim to actively visit a malicious page, this is a lower-risk variant of XSS, but it can still escalate to account compromise or unauthorized modifications within AEM.

• CVE-2026-47983MEDIUM 5.4

  Adobe Experience Manager contains a vulnerability that allows attackers to inject and execute malicious JavaScript code in a victim's browser through specially crafted webpages. The attack requires a user to be logged in (or have an authenticated session) and to visit a malicious link or page, but once that happens, the attacker can steal session data, modify page content, or perform actions on behalf of the victim within the AEM environment. This is a DOM-based XSS vulnerability, meaning the malicious code manipulates how the browser's Document Object Model is rendered rather than relying on unsanitized server-side output.

• CVE-2026-47985MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a vulnerability where attackers can inject malicious JavaScript that runs in a user's browser when they visit a specially crafted webpage. The attack exploits how the application handles dynamic content in the browser's DOM (Document Object Model), allowing an attacker to steal session data, redirect users, or perform actions on their behalf within AEM. This requires the victim to click a link or visit a page—the attacker cannot force exploitation remotely. The vulnerability affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47986MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious JavaScript code into web pages viewed by authenticated users. The vulnerability affects versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker must trick a user into visiting a specially crafted webpage while that user is logged into AEM; the malicious script then executes in the user's browser with their privileges. This can lead to unauthorized actions, data theft, or further compromise depending on the victim's role and permissions.

• CVE-2026-47987MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages. The flaw affects versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the vulnerability. Once executed, the attacker's code runs in the victim's browser with the same privileges as the logged-in user, potentially allowing unauthorized actions or data theft.

• CVE-2026-47989MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw in versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can craft a malicious webpage that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser. This runs within an elevated scope—meaning the attacker gains access to resources and data the victim can access, potentially beyond what a typical reflected XSS would permit. The flaw requires user interaction but poses meaningful risk in multi-tenant or content-collaboration environments where AEM is deployed.

• CVE-2026-47990MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows attackers with basic system access to plant malicious code in form fields. When legitimate users view affected pages, the injected scripts execute in their browsers, potentially compromising sessions, stealing data, or triggering unwanted actions. The vulnerability affects AEM versions 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-47993MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript in a victim's browser. The attack requires the victim to visit a crafted webpage while authenticated to AEM. Because the vulnerability changes the scope of impact, an attacker could potentially affect resources beyond the vulnerable application itself. This is not currently being exploited in the wild according to public threat databases.

• CVE-2026-48192MEDIUM 5.4

  Mendix Studio Pro contains a vulnerability in how it processes project files during the build process. An attacker could craft a malicious project file that, when opened and built by a developer on their local machine, executes arbitrary code with the permissions of that user. This requires social engineering to trick a developer into opening the malicious project, but once opened, the code execution happens automatically during the build pipeline without additional user interaction.

• CVE-2026-48250MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based Cross-Site Scripting (XSS) vulnerability that allows attackers to inject and execute malicious JavaScript in a victim's browser. The vulnerability affects multiple AEM versions (6.5.24, LTS SP1, 2026.04 and earlier) and requires an authenticated user to visit a specially crafted webpage. While the attack requires user interaction and authentication, the scope change means the attacker's privileges can impact resources beyond the vulnerable application itself.

• CVE-2026-48251MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a vulnerability that allows attackers to inject malicious scripts into the DOM, which execute in users' browsers. This DOM-based cross-site scripting (XSS) flaw affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04. Exploitation requires an attacker to trick a user into visiting a specially crafted webpage, making it dependent on user interaction. Once the malicious page loads, the attacker's JavaScript runs within the victim's browser session, potentially allowing theft of session tokens, credential capture, or unauthorized actions on behalf of the user.

• CVE-2026-48256MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM-based cross-site scripting (XSS) flaw. An attacker can craft a malicious webpage that, when visited by an authenticated AEM user, executes JavaScript in the victim's browser with their privileges. The attack requires user interaction—specifically, a victim must click a link or visit the attacker's page—but once triggered, the malicious script runs within the AEM session context, potentially allowing unauthorized actions or data theft.

• CVE-2026-48258MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript code in a victim's browser. The vulnerability affects multiple versions of AEM (6.5.24, LTS SP1, 2026.04 and earlier) and requires an authenticated user with low privileges to click a specially crafted link or visit a malicious webpage. While the impact is limited to theft of session data or minor modification of page content visible to the victim, the cross-scope nature of the vulnerability means the malicious script can access resources and functionality beyond the immediate affected component.

• CVE-2026-48264MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based cross-site scripting vulnerability that allows an authenticated attacker to inject malicious JavaScript into a victim's browser session. The vulnerability affects multiple AEM versions up to and including 6.5.24, LTS SP1, and 2026.04. Successful exploitation requires the victim to visit an attacker-crafted webpage while logged into AEM, making social engineering a prerequisite for impact. The vulnerability carries a CVSS score of 5.4 (Medium), reflecting limited scope but meaningful exposure to confidentiality and integrity.

• CVE-2026-48265MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting vulnerability that allows authenticated attackers to inject malicious JavaScript into a victim's browser session. The flaw requires an attacker to trick a user into visiting a specially crafted webpage while logged into AEM, potentially compromising sensitive data or session integrity. Versions 6.5.24, LTS SP1, 2026.04 and earlier are affected.

• CVE-2026-48266MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages. An attacker would need to trick a user into visiting a specially crafted webpage, where the victim's browser would then execute the attacker's code in the context of their AEM session. This could allow the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim. The vulnerability affects multiple versions of AEM, with scope changes that increase the potential impact surface.

• CVE-2026-48268MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript in a victim's browser. The attack requires the victim to visit a specially crafted webpage while authenticated to an affected AEM instance. An attacker exploiting this could steal session tokens, perform unauthorized actions, or deface content—all within the victim's authenticated session context.

• CVE-2026-48271MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious JavaScript into web pages. The vulnerability requires an attacker to trick a user into visiting a specially crafted webpage while logged into AEM. Once triggered, the malicious script executes in the victim's browser with their permissions, potentially allowing session hijacking, credential theft, or unauthorized actions on behalf of the victim. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-48280MEDIUM 5.4

  Adobe Experience Manager contains a cross-site scripting (XSS) flaw that allows an attacker to inject malicious JavaScript into a user's browser session. The vulnerability is triggered when a victim visits a specially crafted webpage while authenticated to the affected AEM instance. Once executed, the injected code runs with the victim's privileges, potentially allowing theft of session data, unauthorized actions on their behalf, or malware distribution. The issue affects multiple AEM versions including 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-48297MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting vulnerability that allows low-privileged users to embed malicious scripts into form fields. When legitimate users view pages containing these compromised fields, the injected JavaScript executes in their browsers, potentially compromising their sessions or enabling further attacks. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-48299MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling. A low-privileged user can inject malicious JavaScript that persists in the system. When other users view the affected form, the injected script executes in their browsers, potentially stealing session data, credentials, or performing actions on their behalf. The vulnerability requires user interaction (viewing the malicious form) to trigger but can affect users across the platform due to its changed scope classification.

• CVE-2026-48300MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious JavaScript. When a victim visits a page containing an affected form field, the attacker's script executes in their browser, potentially compromising their session or stealing sensitive data. The vulnerability affects multiple versions including 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-48301MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows a low-privileged user to plant malicious code in form fields. When other users visit pages containing these compromised fields, the injected scripts execute in their browsers, potentially stealing session data, credentials, or performing actions on their behalf. The vulnerability affects multiple versions through 2026.04 and requires user interaction—a victim must view the poisoned form—but the attacker needs only basic authentication access to inject the payload.

• CVE-2026-48304MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript into form fields. When other users—typically administrators or content editors—view pages containing these compromised fields, the attacker's script executes in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The vulnerability affects multiple versions through 2026.04 and requires user interaction (the victim must view the poisoned form) but can compromise users with higher privileges than the attacker.

• CVE-2026-48523MEDIUM 5.4

  PyJWT, a widely-used Python library for handling JSON Web Tokens, has a flaw in how it validates token signatures when using JWK (JSON Web Key) objects. Between versions 2.9.0 and 2.12.1, the library checks that a token's advertised algorithm is in the caller's allow-list, but then ignores that check and uses a different algorithm bound to the JWK object for actual verification. This means an attacker with access to a registered private key can craft a token that claims to use an allowed algorithm in its header while being signed with a disallowed algorithm stored in the JWK—and the library will accept it. The fix is available in version 2.13.0.

• CVE-2026-48559MEDIUM 5.4

  Lightweight Music Server (LMS) version 3.76.0 and earlier contains a stored cross-site scripting (XSS) vulnerability in how it handles media file metadata. An attacker can craft a malicious media file with embedded JavaScript in tags like GENRE, ARTIST, or ALBUM, then introduce it into a victim's music library. When the library is scanned, the payload is permanently stored and automatically executes in the web interface whenever that file's metadata is displayed, potentially allowing unauthorized actions on behalf of the logged-in user.

• CVE-2026-48560MEDIUM 5.4

  Microsoft Office SharePoint contains a deserialization flaw that allows an authenticated user to manipulate data in transit, potentially impersonating other users or altering information within the SharePoint environment. The vulnerability requires valid credentials to exploit, limiting exposure to insider threats or compromised accounts rather than unauthenticated internet attackers. The impact is confined to confidentiality and integrity concerns—no system availability is at risk.