By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 67 of 86

• CVE-2026-47957MEDIUM 5.4

  Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. An attacker with low-level system access can inject malicious JavaScript that persists in the application and executes whenever a user views the affected page, potentially allowing credential theft, session hijacking, or malware distribution. The vulnerability requires user interaction—a victim must navigate to the compromised form—but the attacker does not need elevated privileges to introduce the payload.

• CVE-2026-47958MEDIUM 5.4

  Adobe Experience Manager (AEM) versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. A low-privileged user can inject malicious JavaScript that persists in the application and executes when other users view the affected page. Because the vulnerability has a changed scope—meaning the impact crosses trust boundaries—it affects not just the immediate application but potentially other parts of the system or connected domains.

• CVE-2026-47962MEDIUM 5.4

  Adobe Experience Manager is vulnerable to a stored cross-site scripting (XSS) attack where a low-privileged user can inject malicious JavaScript code into form fields. When other users—including administrators or content editors—view the page containing the compromised field, the malicious script executes in their browser. This can lead to credential theft, session hijacking, or unauthorized actions performed on behalf of the victim.

• CVE-2026-47966MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw in form field handling. An attacker with low-level access can inject malicious JavaScript that persists in the application. When other users view the compromised form, the injected script executes in their browsers, potentially allowing credential theft, session hijacking, or further compromise. The vulnerability affects multiple versions through 2026.04 and earlier.

• CVE-2026-47970MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability in form fields that allows attackers with basic user privileges to inject malicious scripts. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially stealing data or performing unauthorized actions. The vulnerability affects multiple AEM versions through 2026.04.

• CVE-2026-47972MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored Cross-Site Scripting flaw that allows low-privileged users to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the attacker's script executes in their browsers, potentially compromising sessions, stealing credentials, or performing actions on their behalf. The vulnerability affects multiple AEM versions through 2026.04.

• CVE-2026-47973MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious scripts into form fields. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially stealing credentials, session tokens, or sensitive data. The vulnerability affects multiple versions of AEM, including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47974MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows attackers with low-level user access to inject malicious JavaScript into form fields. When other users view those compromised pages, the malicious code runs in their browsers. This is a scope-change vulnerability, meaning an attacker can potentially affect users beyond their normal permission level. The vulnerability affects multiple recent versions of AEM.

• CVE-2026-47975MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows attackers with basic user privileges to inject malicious scripts into form fields. When legitimate users visit pages containing these compromised fields, the attacker's JavaScript executes in their browsers. This is distinct from reflected XSS because the malicious payload persists in the application's database, affecting all subsequent visitors. The vulnerability requires user interaction—a victim must view the poisoned page—but the attacker needs only low-level access to inject the payload initially.

• CVE-2026-47977MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw in certain form fields. An attacker with low-level system access can embed malicious JavaScript into these fields, and that script executes automatically when other users view the affected page. The vulnerability requires user interaction (victims must visit the page), but the stored nature means the attack persists and affects anyone who accesses the compromised content.

• CVE-2026-47978MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with low-level account privileges to embed malicious scripts into form fields. When legitimate users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers, potentially compromising their sessions or stealing sensitive data. This is a *stored* vulnerability, meaning the malicious payload persists in the application until remediated—unlike reflected XSS that requires a crafted link. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04, and earlier.

• CVE-2026-47980MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious scripts. When a victim visits a page containing an affected form field, the injected JavaScript executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim. The vulnerability affects versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47981MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows attackers with basic user privileges to embed malicious code into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-47982MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a cross-site scripting (XSS) flaw in versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can craft a malicious webpage that, when visited by an authenticated AEM user, executes arbitrary JavaScript in the user's browser session. The attack manipulates the page's DOM to inject and run hostile code, potentially allowing the attacker to steal session tokens, modify content, or perform actions on behalf of the victim. Because exploitation requires the victim to actively visit a malicious page, this is a lower-risk variant of XSS, but it can still escalate to account compromise or unauthorized modifications within AEM.

• CVE-2026-47983MEDIUM 5.4

  Adobe Experience Manager contains a vulnerability that allows attackers to inject and execute malicious JavaScript code in a victim's browser through specially crafted webpages. The attack requires a user to be logged in (or have an authenticated session) and to visit a malicious link or page, but once that happens, the attacker can steal session data, modify page content, or perform actions on behalf of the victim within the AEM environment. This is a DOM-based XSS vulnerability, meaning the malicious code manipulates how the browser's Document Object Model is rendered rather than relying on unsanitized server-side output.

• CVE-2026-47985MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a vulnerability where attackers can inject malicious JavaScript that runs in a user's browser when they visit a specially crafted webpage. The attack exploits how the application handles dynamic content in the browser's DOM (Document Object Model), allowing an attacker to steal session data, redirect users, or perform actions on their behalf within AEM. This requires the victim to click a link or visit a page—the attacker cannot force exploitation remotely. The vulnerability affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04.

• CVE-2026-47986MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious JavaScript code into web pages viewed by authenticated users. The vulnerability affects versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker must trick a user into visiting a specially crafted webpage while that user is logged into AEM; the malicious script then executes in the user's browser with their privileges. This can lead to unauthorized actions, data theft, or further compromise depending on the victim's role and permissions.

• CVE-2026-47987MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages. The flaw affects versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker would need to trick a user into visiting a specially crafted webpage to trigger the vulnerability. Once executed, the attacker's code runs in the victim's browser with the same privileges as the logged-in user, potentially allowing unauthorized actions or data theft.

• CVE-2026-47989MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw in versions 6.5.24, LTS SP1, 2026.04 and earlier. An attacker can craft a malicious webpage that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser. This runs within an elevated scope—meaning the attacker gains access to resources and data the victim can access, potentially beyond what a typical reflected XSS would permit. The flaw requires user interaction but poses meaningful risk in multi-tenant or content-collaboration environments where AEM is deployed.

• CVE-2026-47990MEDIUM 5.4

  Adobe Experience Manager has a stored cross-site scripting (XSS) vulnerability that allows attackers with basic system access to plant malicious code in form fields. When legitimate users view affected pages, the injected scripts execute in their browsers, potentially compromising sessions, stealing data, or triggering unwanted actions. The vulnerability affects AEM versions 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-47993MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript in a victim's browser. The attack requires the victim to visit a crafted webpage while authenticated to AEM. Because the vulnerability changes the scope of impact, an attacker could potentially affect resources beyond the vulnerable application itself. This is not currently being exploited in the wild according to public threat databases.

• CVE-2026-48192MEDIUM 5.4

  Mendix Studio Pro contains a vulnerability in how it processes project files during the build process. An attacker could craft a malicious project file that, when opened and built by a developer on their local machine, executes arbitrary code with the permissions of that user. This requires social engineering to trick a developer into opening the malicious project, but once opened, the code execution happens automatically during the build pipeline without additional user interaction.

• CVE-2026-48250MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based Cross-Site Scripting (XSS) vulnerability that allows attackers to inject and execute malicious JavaScript in a victim's browser. The vulnerability affects multiple AEM versions (6.5.24, LTS SP1, 2026.04 and earlier) and requires an authenticated user to visit a specially crafted webpage. While the attack requires user interaction and authentication, the scope change means the attacker's privileges can impact resources beyond the vulnerable application itself.

• CVE-2026-48251MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a vulnerability that allows attackers to inject malicious scripts into the DOM, which execute in users' browsers. This DOM-based cross-site scripting (XSS) flaw affects multiple versions of AEM up to and including 6.5.24, LTS SP1, and 2026.04. Exploitation requires an attacker to trick a user into visiting a specially crafted webpage, making it dependent on user interaction. Once the malicious page loads, the attacker's JavaScript runs within the victim's browser session, potentially allowing theft of session tokens, credential capture, or unauthorized actions on behalf of the user.

• CVE-2026-48256MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM-based cross-site scripting (XSS) flaw. An attacker can craft a malicious webpage that, when visited by an authenticated AEM user, executes JavaScript in the victim's browser with their privileges. The attack requires user interaction—specifically, a victim must click a link or visit the attacker's page—but once triggered, the malicious script runs within the AEM session context, potentially allowing unauthorized actions or data theft.

• CVE-2026-48258MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript code in a victim's browser. The vulnerability affects multiple versions of AEM (6.5.24, LTS SP1, 2026.04 and earlier) and requires an authenticated user with low privileges to click a specially crafted link or visit a malicious webpage. While the impact is limited to theft of session data or minor modification of page content visible to the victim, the cross-scope nature of the vulnerability means the malicious script can access resources and functionality beyond the immediate affected component.

• CVE-2026-48264MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based cross-site scripting vulnerability that allows an authenticated attacker to inject malicious JavaScript into a victim's browser session. The vulnerability affects multiple AEM versions up to and including 6.5.24, LTS SP1, and 2026.04. Successful exploitation requires the victim to visit an attacker-crafted webpage while logged into AEM, making social engineering a prerequisite for impact. The vulnerability carries a CVSS score of 5.4 (Medium), reflecting limited scope but meaningful exposure to confidentiality and integrity.

• CVE-2026-48265MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based Cross-Site Scripting vulnerability that allows authenticated attackers to inject malicious JavaScript into a victim's browser session. The flaw requires an attacker to trick a user into visiting a specially crafted webpage while logged into AEM, potentially compromising sensitive data or session integrity. Versions 6.5.24, LTS SP1, 2026.04 and earlier are affected.

• CVE-2026-48266MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript code into web pages. An attacker would need to trick a user into visiting a specially crafted webpage, where the victim's browser would then execute the attacker's code in the context of their AEM session. This could allow the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim. The vulnerability affects multiple versions of AEM, with scope changes that increase the potential impact surface.

• CVE-2026-48268MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a DOM-based cross-site scripting (XSS) vulnerability that allows an attacker to inject and execute malicious JavaScript in a victim's browser. The attack requires the victim to visit a specially crafted webpage while authenticated to an affected AEM instance. An attacker exploiting this could steal session tokens, perform unauthorized actions, or deface content—all within the victim's authenticated session context.

• CVE-2026-48271MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a DOM-based cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious JavaScript into web pages. The vulnerability requires an attacker to trick a user into visiting a specially crafted webpage while logged into AEM. Once triggered, the malicious script executes in the victim's browser with their permissions, potentially allowing session hijacking, credential theft, or unauthorized actions on behalf of the victim. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-48280MEDIUM 5.4

  Adobe Experience Manager contains a cross-site scripting (XSS) flaw that allows an attacker to inject malicious JavaScript into a user's browser session. The vulnerability is triggered when a victim visits a specially crafted webpage while authenticated to the affected AEM instance. Once executed, the injected code runs with the victim's privileges, potentially allowing theft of session data, unauthorized actions on their behalf, or malware distribution. The issue affects multiple AEM versions including 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-48297MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting vulnerability that allows low-privileged users to embed malicious scripts into form fields. When legitimate users view pages containing these compromised fields, the injected JavaScript executes in their browsers, potentially compromising their sessions or enabling further attacks. The vulnerability affects AEM versions 6.5.24, LTS SP1, 2026.04 and earlier.

• CVE-2026-48299MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling. A low-privileged user can inject malicious JavaScript that persists in the system. When other users view the affected form, the injected script executes in their browsers, potentially stealing session data, credentials, or performing actions on their behalf. The vulnerability requires user interaction (viewing the malicious form) to trigger but can affect users across the platform due to its changed scope classification.

• CVE-2026-48300MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability in form field handling that allows low-privileged users to inject malicious JavaScript. When a victim visits a page containing an affected form field, the attacker's script executes in their browser, potentially compromising their session or stealing sensitive data. The vulnerability affects multiple versions including 6.5.24, LTS SP1, and 2026.04 and earlier.

• CVE-2026-48301MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows a low-privileged user to plant malicious code in form fields. When other users visit pages containing these compromised fields, the injected scripts execute in their browsers, potentially stealing session data, credentials, or performing actions on their behalf. The vulnerability affects multiple versions through 2026.04 and requires user interaction—a victim must view the poisoned form—but the attacker needs only basic authentication access to inject the payload.

• CVE-2026-48304MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript into form fields. When other users—typically administrators or content editors—view pages containing these compromised fields, the attacker's script executes in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The vulnerability affects multiple versions through 2026.04 and requires user interaction (the victim must view the poisoned form) but can compromise users with higher privileges than the attacker.

• CVE-2026-48523MEDIUM 5.4

  PyJWT, a widely-used Python library for handling JSON Web Tokens, has a flaw in how it validates token signatures when using JWK (JSON Web Key) objects. Between versions 2.9.0 and 2.12.1, the library checks that a token's advertised algorithm is in the caller's allow-list, but then ignores that check and uses a different algorithm bound to the JWK object for actual verification. This means an attacker with access to a registered private key can craft a token that claims to use an allowed algorithm in its header while being signed with a disallowed algorithm stored in the JWK—and the library will accept it. The fix is available in version 2.13.0.

• CVE-2026-48559MEDIUM 5.4

  Lightweight Music Server (LMS) version 3.76.0 and earlier contains a stored cross-site scripting (XSS) vulnerability in how it handles media file metadata. An attacker can craft a malicious media file with embedded JavaScript in tags like GENRE, ARTIST, or ALBUM, then introduce it into a victim's music library. When the library is scanned, the payload is permanently stored and automatically executes in the web interface whenever that file's metadata is displayed, potentially allowing unauthorized actions on behalf of the logged-in user.

• CVE-2026-48560MEDIUM 5.4

  Microsoft Office SharePoint contains a deserialization flaw that allows an authenticated user to manipulate data in transit, potentially impersonating other users or altering information within the SharePoint environment. The vulnerability requires valid credentials to exploit, limiting exposure to insider threats or compromised accounts rather than unauthenticated internet attackers. The impact is confined to confidentiality and integrity concerns—no system availability is at risk.

• CVE-2026-48928MEDIUM 5.4

  Node.js has a flaw in how it validates hostnames during mutual TLS (mTLS) authentication. When applications use mTLS across multiple security contexts, the inconsistent hostname matching logic can allow an authenticated user to bypass trust policies they shouldn't have access to. The vulnerability requires the attacker to already have valid credentials, limiting the immediate blast radius, but the trust-policy bypass itself creates a privilege escalation or lateral movement path in zero-trust or multi-tenant environments.

• CVE-2026-49192MEDIUM 5.4

  A flaw in the Acer Connect M6E 5G device's summary service endpoint allows authenticated users to bypass ownership checks and access device data they don't own. An attacker with valid credentials can enumerate and scrape hardware information by manipulating device serial numbers in API requests, leading to unauthorized disclosure of device details across the user base.

• CVE-2026-49231MEDIUM 5.4

  Apache APISIX versions 3.5.0 through 3.16.0 contain an authentication bypass flaw in the OPA (Open Policy Agent) plugin. An attacker with valid credentials can craft spoofed identity headers that the OPA plugin relays upstream without proper validation, allowing privilege escalation on connected services. The vulnerability only manifests in non-default configurations, meaning deployments using standard settings are not affected.

• CVE-2026-49782MEDIUM 5.4

  Elementor Website Builder versions up to 4.1.0 contain a missing authorization flaw that allows authenticated users to perform actions they shouldn't be permitted to perform. An attacker with valid login credentials can exploit incorrectly configured access control settings to gain unauthorized access to sensitive features or data. This is not an unauthenticated attack—the attacker needs a legitimate user account first—but it meaningfully weakens the security boundary between user privilege levels.

• CVE-2026-5005MEDIUM 5.4

  CVE-2026-5005 is a stored cross-site scripting (XSS) vulnerability in Twiser Informatics Technology Consulting's OKRs & Goals application. An authenticated user can inject malicious JavaScript that persists in the application and executes in the browsers of other users who view the affected content. This allows attackers to steal session tokens, redirect users to phishing sites, or perform actions on behalf of victims without their knowledge.

• CVE-2026-50221MEDIUM 5.4

  OpenStack Swift's proxy server fails to filter out special internal headers from client requests before sending them to storage servers. An attacker with legitimate write access can exploit this to redirect storage operations to servers they control, exposing sensitive cluster information like encryption keys and internal topology details. This is a server-side request forgery (SSRF) vulnerability that requires existing authentication but can cause significant data exposure.

• CVE-2026-50591MEDIUM 5.4

  Znuny, a popular open-source ticketing and service management platform, contains a stored cross-site scripting (XSS) vulnerability in its user preference settings. An authenticated attacker can inject malicious scripts into their profile preferences, which are then executed in the browsers of other users viewing that profile. This affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3. The vulnerability requires an attacker to have valid login credentials and user interaction (another user must visit the attacker's profile) to trigger the payload.

• CVE-2026-5069MEDIUM 5.4

  The Fluent Forms WordPress plugin contains a flaw that allows subscribers to cancel payment subscriptions belonging to other users. An attacker with basic user access can manipulate a subscription ID parameter to submit cancellation requests for any subscription in the system, potentially disrupting service for legitimate customers. The vulnerability affects versions up to 6.2.1 and requires authentication—a casual visitor cannot exploit it.

• CVE-2026-50740MEDIUM 5.4

  Revive Adserver versions 6.0.7 and earlier contain a reflected cross-site scripting (XSS) vulnerability in the zone-include.php script. An authenticated user with low-level privileges can inject malicious code through the refresh parameter of the iFrame invocation tag, which is then executed in the browsers of other users who view affected content. This does not require administrator access, making it accessible to ordinary users within an organization running the platform.

• CVE-2026-50742MEDIUM 5.4

  Revive Adserver 6.0.7 contains a stored cross-site scripting (XSS) vulnerability in two administrative maintenance tools: `maintenance-acl-check.php` and `maintenance-banners-check.php`. When these tools detect inconsistencies in the system, they display entity names without properly escaping them first. This allows an attacker to inject malicious JavaScript that gets stored and executed in an administrator's browser when they use these tools. Execution depends on an admin actually running the maintenance checks, which the attacker cannot directly control.

• CVE-2026-50766MEDIUM 5.4

  A stored cross-site scripting (XSS) vulnerability exists in Koha Library Management System versions 0 through 25.11. An authenticated staff member with permission to edit item records can inject malicious JavaScript code into the public notes field of library items. When other users view the item details page in the public catalog, this injected script executes in their browsers, potentially compromising their sessions or stealing sensitive information. This is a stored attack, meaning the malicious payload persists in the system until removed.

• CVE-2026-50767MEDIUM 5.4

  Koha Library Management System contains a stored cross-site scripting (XSS) vulnerability in its item type administration interface. An authenticated administrator can inject malicious scripts into the check-in message field, which are then stored and executed in the browsers of other users who view that item type. This is a persistence threat rather than a one-time attack—the malicious script remains embedded until manually removed.

• CVE-2026-50876MEDIUM 5.4

  Deck9 Input version 2.0.1 contains a cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious scripts or HTML into web pages. An attacker with login credentials could craft a specially designed payload that, when viewed by another user, executes arbitrary code in that user's browser session. This could lead to session hijacking, credential theft, or unauthorized actions taken on behalf of the victim.

• CVE-2026-5139MEDIUM 5.4

  Mattermost has a flaw in how it controls access to GitLab integration settings. Any logged-in user can run a slash command (/gitlab connect) to change which GitLab instance the entire Mattermost workspace uses by default. This should only be allowed for administrators. An attacker with any valid Mattermost account could redirect the workspace to a malicious GitLab instance, potentially capturing credentials or injecting compromised code through pull requests and CI/CD pipelines.

• CVE-2026-5191MEDIUM 5.4

  The Tiled Gallery Carousel Without JetPack WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 3.1. An attacker with contributor-level access or higher can inject malicious scripts into gallery image titles that will execute in the browsers of anyone viewing the affected page. This is a persistence concern because the malicious code is permanently stored in the site's database.

• CVE-2026-52779MEDIUM 5.4

  OpenProject versions before 17.3.3 and 17.4.1 contain a flaw that allows a project manager in one project to delete shared views (Calendar or Team Planner queries) from another project they shouldn't have access to. The vulnerability stems from the application checking permissions against the wrong project context, then loading the actual view without re-validating ownership. An attacker exploits this by leveraging their legitimate management role in one project to sabotage shared work views in a separate project, disrupting collaboration for other users.

• CVE-2026-52802MEDIUM 5.4

  Gogs, a self-hosted Git service, contains an open redirect vulnerability that allows attackers to trick users into visiting arbitrary external websites. The vulnerability exists because Gogs' validation function checks only the first two characters of a URL, missing a technique where directory traversal sequences followed by backslashes can bypass the security check. An attacker would need to social-engineer a user into clicking a malicious link, but once clicked, the user is silently redirected off the Gogs platform. This issue is resolved in version 0.14.3 and later.

• CVE-2026-5309MEDIUM 5.4

  GitLab EE contains an authorization bypass vulnerability affecting virtual registry cleanup policies. An authenticated user can read or modify cleanup policy settings for groups they do not own or have explicit access to. The flaw exists across multiple version lines and requires an authenticated attacker—no special privileges or user interaction is needed beyond login credentials.

• CVE-2026-53441MEDIUM 5.4

  Jenkins versions 2.483–2.567 and LTS 2.492.1–2.555.2 contain a stored cross-site scripting (XSS) vulnerability in how they handle user-supplied descriptions for generic offline causes. An attacker with Agent/Configure permissions can inject malicious script into the offline cause description via the POST config.xml API, and that script will execute in the browsers of other users who view the Jenkins interface. This is a classic stored XSS—the payload persists in Jenkins' configuration until removed.

• CVE-2026-53606MEDIUM 5.4

  The sanitize-html library, which removes malicious content from HTML before display, has a configuration flaw that allows JavaScript code injection attacks. When developers configure the library to permit certain HTML attributes (like `action`, `formaction`, `data`, `poster`, `background`, or `ping`), the library fails to block dangerous `javascript:` URIs in those fields. This means attackers can craft HTML that executes JavaScript in a user's browser without the user realizing it—a classic cross-site scripting (XSS) vulnerability. The flaw exists because the library only checks URI safety for a limited set of attributes by default, missing several others defined by the HTML standard. Version 2.17.5 closes this gap.

• CVE-2026-53722MEDIUM 5.4

  Nuxt, a popular Vue.js development framework, contains a cross-site scripting vulnerability in its <NuxtLink> component. The component fails to validate URL schemes in values bound to its `to` or `href` props, allowing attackers to inject malicious javascript: or vbscript: URLs. When a user clicks a link crafted this way, arbitrary JavaScript executes within the application's origin. The vulnerability affects versions before 3.21.7 and 4.4.7. Exploitation requires an attacker to control input that binds to the component—such as query parameters, CMS fields, or user profile URLs—and a user to click the malicious link.

• CVE-2026-53740MEDIUM 5.4

  The Yoast Duplicate Post WordPress plugin through version 4.6 contains a stored cross-site scripting (XSS) vulnerability in its scheduled republish feature. When an administrator views a scheduled republish notice in the Classic Editor, the plugin fails to properly escape the crafted post title and permalink, allowing an attacker with contributor-level access to inject and execute malicious JavaScript. This occurs because the plugin inserts user-controlled content directly into the notice without sanitization.

• CVE-2026-53741MEDIUM 5.4

  Simple Link Directory versions up to 9.0.4 contain a stored cross-site scripting (XSS) vulnerability in the 'sld_no_results_found' option. An authenticated user can inject malicious JavaScript that persists in the application's configuration. When the plugin renders this option on the frontend, the payload breaks out of its intended string context and executes in the browser of every visitor, potentially compromising site visitors' sessions, stealing credentials, or spreading malware.

• CVE-2026-53742MEDIUM 5.4

  Simple Link Directory, a WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 9.0.4. The vulnerability exists in how the embed shortcode feature handles user-supplied attributes—specifically, it fails to properly escape these attributes when writing them into HTML data attributes. An attacker with WordPress contributor-level access can inject malicious JavaScript code through crafted shortcode parameters. When a site visitor views the affected embedded content, the injected script executes in their browser with their privileges, potentially allowing account compromise or malicious actions performed on their behalf.

• CVE-2026-53847MEDIUM 5.4

  OpenClaw versions prior to 2026.5.6 contain a privilege escalation flaw affecting users with operator.write permissions. These users can bypass intended access controls to modify global configuration settings normally restricted to administrator-level accounts. The vulnerability stems from insufficient validation of permission scope boundaries, allowing write operations to affect system-wide settings beyond what the operator.write role should permit.

• CVE-2026-53852MEDIUM 5.4

  OpenClaw versions before 2026.4.25 contain a flaw that allows authenticated operators to bypass access control restrictions when re-pairing devices. By submitting re-pairing requests with empty scope parameters, an attacker can trick the system into granting broader device access than should be permitted. This is a privilege-escalation vulnerability affecting users who already have some level of access to the system.

• CVE-2026-53907MEDIUM 5.4

  MCO (My Compliance Office) contains a stored cross-site scripting vulnerability in its logo upload feature. An authenticated attacker can upload a specially crafted SVG file containing malicious JavaScript that executes when other users view or render the logo. The vulnerability requires user interaction and authenticated access, but once exploited, affects all users who load the compromised logo, making it a persistent threat within the application.

• CVE-2026-53946MEDIUM 5.4

  Ghost, a popular Node.js content management system, contains a server-side request forgery (SSRF) vulnerability in versions 6.19.4 through 6.21.0. When a staff user re-renders posts containing image cards, Ghost automatically fetches missing image dimensions by making outbound HTTP requests to image URLs—without validating that those URLs point to trusted hosts. An authenticated attacker could exploit this by crafting a post with an image card pointing to an internal network resource, a cloud metadata endpoint, or any other URL normally unreachable from the Ghost server. The server would then issue the request on the attacker's behalf, potentially leaking sensitive internal information or credentials.

• CVE-2026-53948MEDIUM 5.4

  Ghost, a popular Node.js content management system, contains a vulnerability in its Admin API file upload feature that allows attackers to trick the system into serving uploaded files with incorrect content types. An authenticated attacker could upload a file and specify a malicious content type—for example, declaring an HTML file as a text file. When Ghost serves these files from the same origin as the website itself (a common configuration), visitors or staff members could be tricked into executing the attacker's code, compromising their browsers or sessions. This vulnerability affects Ghost versions 6.19.4 through 6.21.0 and is resolved in version 6.21.1.

• CVE-2026-53962MEDIUM 5.4

  Discourse, a popular open-source discussion platform, has a vulnerability in how it sanitizes uploaded SVG files and user avatars. An attacker with a user account could craft a malicious SVG that executes JavaScript in the browser when specific non-standard URLs are accessed. This requires user interaction (clicking a link) and only affects visitors to those particular URLs, not the general community experience. The vulnerability has been patched in recent versions across multiple release branches.

• CVE-2026-54025MEDIUM 5.4

  LibreChat, a popular open-source ChatGPT alternative supporting multiple AI providers, contains a stored cross-site scripting (XSS) vulnerability in its markdown artifact preview system. When a user includes an image in a markdown artifact with specially crafted alt text, the application fails to properly escape double-quote characters. An attacker can exploit this to inject malicious JavaScript code that executes in the victim's browser when the preview renders. The flaw exists because LibreChat's custom image renderer defers to a third-party library's default handler under certain conditions, and that handler does not sanitize the alt text before inserting it into HTML attributes. The vulnerability requires user interaction (viewing a preview) and authenticated access, limiting its scope but still posing a meaningful risk to collaborative environments.

• CVE-2026-54301MEDIUM 5.4

  n8n, an open source workflow automation platform, contains a cross-site scripting (XSS) vulnerability in its Respond to Webhook node. An authenticated user with workflow edit permissions can configure the node to serve binary content with a malicious Content-Type header. Because the binary response path bypasses n8n's Content-Security-Policy protections, this allows arbitrary JavaScript to execute in the n8n web application origin—meaning attackers can access the authenticated user's session and credentials when that user visits a specially crafted public webhook URL. The vulnerability requires an authenticated attacker and user interaction, but the damage is confined to the victim's n8n account and the data it can access.

• CVE-2026-54302MEDIUM 5.4

  n8n, a popular open-source workflow automation platform, contains a stored cross-site scripting (XSS) vulnerability in its Chat Trigger feature. An authenticated user with permission to edit workflows can inject malicious JavaScript code by manipulating the webhookId parameter. When another logged-in user visits the generated chat URL, that injected code executes within the n8n application context, giving the attacker access to the victim's session and permissions. The vulnerability requires both authentication and user interaction to exploit, limiting its immediate blast radius but remaining a meaningful risk in multi-tenant or shared n8n deployments.

• CVE-2026-54303MEDIUM 5.4

  n8n, an open source workflow automation platform, contains a reflected cross-site scripting (XSS) vulnerability in its Meta and Microsoft Teams trigger node endpoints. When a logged-in n8n user clicks a specially crafted link, the endpoint reflects unsanitized query parameters directly into the HTTP response. Because the application lacks Content-Security-Policy headers, an attacker's malicious JavaScript executes in the context of the n8n application, potentially allowing session hijacking, credential theft, or unauthorized workflow modifications. The vulnerability affects all versions prior to 2.24.0.

• CVE-2026-54477MEDIUM 5.4

  CVE-2026-54477 describes a security misconfiguration in an admin panel where standard HTTP security headers are absent. This omission creates two distinct attack vectors: clickjacking (where an attacker tricks an admin into clicking hidden UI elements by overlaying the legitimate admin panel) and cross-site scripting (XSS, where malicious scripts execute in the admin's browser context). Both attacks require user interaction, and both can lead to unauthorized actions or information disclosure within the admin interface.

• CVE-2026-54720MEDIUM 5.4

  Silverstripe CMS contains a cross-site scripting (XSS) vulnerability in its media embedding feature. When a CMS user inserts media from the web using a specially crafted embed URL, an attacker can inject malicious code that executes in the user's browser session. This requires user interaction—specifically, a CMS administrator or editor must attempt to embed the attacker's malicious URL—but once triggered, it can compromise the user's CMS credentials or session. The vulnerability affects Silverstripe Framework versions before 6.2.2.

• CVE-2026-55170MEDIUM 5.4

  OpenFGA, an authorization engine used by developers to manage access control, has a case-sensitivity flaw when running on MySQL databases. Prior to version 1.18.0, the system incorrectly treats distinct user identifiers like 'user:Alice' and 'user:alice' as the same, leading to authorization decisions being applied interchangeably. An authenticated user could exploit this to gain access permissions intended for a different user if naming conventions differ only in capitalization. The issue affects how the system stores and retrieves tuples (permission rules), changelogs, and authorization models from the database.

• CVE-2026-55424MEDIUM 5.4

  Discourse forums can be vulnerable to JavaScript injection through topic featured links. If a user with permission to set a featured link on a topic crafts a malicious link, it could execute arbitrary JavaScript in other users' browsers when they view the topic list—but only if the site administrator has modified or disabled Discourse's default Content Security Policy. This is a stored cross-site scripting (XSS) vulnerability that affects multiple Discourse release branches.

• CVE-2026-55432MEDIUM 5.4

  Coder, a platform for provisioning remote development environments, contains a flaw in how it handles app sharing permissions within workspaces. When workspace owners create sub-agent applications, the system fails to enforce the administrator-set sharing level limits before saving these apps. This allows a workspace owner to grant broader access to their applications than the organization's policy permits. Attackers must already have workspace owner privileges to exploit this issue, which limits the immediate blast radius but represents a meaningful policy bypass for organizations using Coder to control data exposure.

• CVE-2026-55433MEDIUM 5.4

  Coder, a platform for provisioning remote development environments, contains an authorization flaw in its devcontainer rebuild feature. Attackers with valid low-privilege workspace access can trigger a destructive environment rebuild without the proper permission checks, leading to loss of work and service disruption. The vulnerability affects Coder versions before 2.29.7, 2.32.7, 2.33.8, and 2.34.2. A fix has been released that adds the missing authorization validation.

• CVE-2026-55435MEDIUM 5.4

  Coder, a platform for provisioning remote development environments via Terraform, has a flaw in how it validates user access to AI Bridge proxy endpoints. The vulnerability allows users whose accounts have been suspended to continue using previously-issued API keys to access those endpoints, because the suspension process doesn't automatically revoke existing tokens. The issue affects Coder versions 2.30.0 through 2.34.1. While this is a real access-control bypass, its practical scope is narrow: it only impacts API keys that were issued before a user's account was suspended, and only until those keys are manually deleted. In most organizations, suspended users have limited outstanding valid keys, and the keys themselves expire over time.

• CVE-2026-55437MEDIUM 5.4

  Coder, a platform for provisioning remote development environments, contains a stored cross-site scripting (XSS) vulnerability in its dashboard logging component. When workspace agent logs contain HTML or script code, the dashboard renders this content as live markup rather than displaying it as plain text. An attacker who can control what appears in agent logs can inject malicious scripts that execute in the browser of any user viewing those logs. This requires the attacker to first compromise or control a workspace agent, then trick an administrator or developer into viewing the poisoned logs.

• CVE-2026-55745MEDIUM 5.4

  Cotonti 1.0.0 contains a cross-site request forgery (CSRF) vulnerability in its Personal File Storage module. When an authenticated user visits a malicious website, an attacker can trick their browser into sending unauthorized requests that change folder settings—such as converting a private folder to public—without the user's knowledge or consent. The vulnerability exists because the affected code path doesn't validate anti-CSRF tokens before processing folder updates.

• CVE-2026-56023MEDIUM 5.4

  A broken access control vulnerability exists in the UPI QR Code Payment Gateway plugin for WooCommerce affecting versions 1.6.2 and earlier. An authenticated user with low privileges can manipulate payment-related data or operations in ways that should be restricted, potentially altering transaction integrity or customer information. The vulnerability requires an attacker to be logged into the system but does not require additional user interaction to exploit.

• CVE-2026-56224MEDIUM 5.4

  Capgo's web console at console.capgo.app/login versions before 12.128.2 has a design flaw that allows authentication tokens to be passed directly in web links. An attacker can send a victim a specially crafted link containing valid access and refresh tokens; when clicked, the victim is automatically logged into the attacker's account without any confirmation step. This exposes the tokens in the victim's browser history, cached logs, and server access logs, creating multiple avenues for token theft and account compromise.

• CVE-2026-56227MEDIUM 5.4

  Capgo versions before 12.128.2 allow organization administrators to configure webhooks that point to internal or localhost addresses, a weakness in how the system validates webhook URLs. When these webhooks are triggered, the backend server makes outbound requests to these internal addresses and may leak error details to users. This creates a pathway for privileged insiders to probe internal systems or services running on the server itself.

• CVE-2026-56283MEDIUM 5.4

  Capgo versions prior to 12.128.2 contain an HTML injection vulnerability in the organization settings area. An authenticated attacker can inject malicious HTML into the organization name field, potentially redirecting users to fake websites designed for phishing or damaging the organization's reputation. The vulnerability requires user interaction—an administrator or team member must visit the affected settings page—but once triggered, the injected content can affect multiple users viewing that organization's settings.

• CVE-2026-56293MEDIUM 5.4

  Capgo versions prior to 12.128.2 have a flaw in how they handle application transfers between organizations. When an app is moved from one organization to another, the system fails to properly update ownership records for the deployment history—a record of all previous deployments and changes. This means attackers who had access to an app in the source organization can retain visibility into its deployment history even after transfer, or the receiving organization may lose the ability to access the transferred app's deployment records. The vulnerability requires authentication to exploit, limiting immediate risk but still allowing insider or compromised-account attacks.

• CVE-2026-56309MEDIUM 5.4

  Capgo, a mobile app backend service, contains a vulnerability that allows authenticated users to upload files to a shared storage system without respecting their account's plan limitations. An attacker with upload permissions could bypass restrictions meant to prevent certain app tiers from accessing the file upload feature, effectively storing unlimited data on Capgo's infrastructure and potentially downloading it repeatedly at no cost. The uploaded files persist even after an app is deleted, creating a storage and bandwidth waste problem for Capgo and its legitimate users.

• CVE-2026-56356MEDIUM 5.4

  n8n's Chat Trigger node has a stored cross-site scripting (XSS) flaw in its Custom CSS field. A workflow creator or editor can inject malicious JavaScript that gets saved in the workflow and executes when anyone visits the public chat page. This affects n8n versions before 1.123.27, versions 2.0.0 through 2.13.2, and version 2.14.0. The vulnerability requires authenticated access to create or modify workflows, so it's limited to users with those permissions, but the actual attack—XSS against chat visitors—happens without further interaction needed from those visitors.

• CVE-2026-56358MEDIUM 5.4

  n8n, a popular workflow automation platform, has a stored cross-site scripting (XSS) vulnerability in its Form Trigger node. Users with permission to create workflows can embed malicious code into form designs that will execute automatically whenever someone visits the form. This affects n8n versions before 1.123.25 (in the 1.x line) and before 2.11.2 (in the 2.x line), with a fix also available in 2.12.0. The vulnerability requires the attacker to already have workflow creation access, limiting the immediate blast radius but creating significant risk for organizations where multiple users can design forms.

• CVE-2026-56359MEDIUM 5.4

  n8n versions prior to 2.8.0 contain a cross-site scripting (XSS) vulnerability in the credential management system. Authenticated users can inject malicious JavaScript into OAuth2 credential fields, specifically the Authorization URL. If a victim clicks the OAuth authorization button while viewing a crafted malicious credential, arbitrary JavaScript executes in their browser with their session privileges. This requires both authentication and user interaction, limiting its scope but creating a meaningful risk in shared or collaborative n8n deployments.

• CVE-2026-56458MEDIUM 5.4

  HCL DevOps Deploy contains a Cross-Origin Resource Sharing (CORS) configuration flaw that allows attackers to bypass domain restrictions. An attacker can craft a malicious webpage that, when visited by a DevOps Deploy user, performs unauthorized actions or steals sensitive information on behalf of that user. This works because the application does not properly validate which domains are allowed to make cross-origin requests to it.

• CVE-2026-56694MEDIUM 5.4

  NanoClaw versions before 2.1.0 contain a privilege escalation flaw in how it approves and registers communication channels. A scoped administrator can exploit weak validation in the channel approval process to wire messaging channels into agent groups they don't have permission to access. This allows unauthorized viewing or control of activity in restricted agent groups—essentially letting an admin operate outside their intended scope.

• CVE-2026-56696MEDIUM 5.4

  OpenHarness contains a vulnerability in its slash command handlers that allows authenticated remote users to inject malicious content into project configuration files. When a user issues /issue or /pr_comments commands, the system fails to validate that these commands come from trusted sources. An attacker with channel access can craft commands that write arbitrary Markdown into sensitive files (.openharness/issue.md and .openharness/pr_comments.md) that get loaded into AI agent system prompts. This creates a persistent injection attack where the agent's behavior is influenced by attacker-controlled instructions on every subsequent run.

• CVE-2026-56774MEDIUM 5.4

  Kanboard versions up to 1.2.52 contain a flaw that allows any logged-in user to forcibly log out other users, including administrators. The vulnerability stems from insufficient validation of session identifiers when processing remember-me cookie deletions. An attacker with valid credentials can systematically enumerate and invalidate persistent login tokens belonging to other accounts, disrupting operations and forcing legitimate users to re-authenticate. This is a classic privilege escalation scenario where ordinary user permissions are abused to cause service disruption at scale.

• CVE-2026-56775MEDIUM 5.4

  n8n workflow automation platform versions before 1.123.55, 2.25.7, and 2.26.2 contain an authorization flaw in test-run management endpoints. The vulnerability allows authenticated users with read-only viewer permissions to perform state-changing actions—starting new test runs, canceling active runs, and deleting run records—on workflows they should only be able to view. This affects deployments using n8n's Advanced Permissions feature (Enterprise and Cloud editions) with project-based access controls. The flaw stems from incorrect permission scope validation during endpoint authorization.

• CVE-2026-56823MEDIUM 5.4

  AutoGPT, a workflow automation platform for managing AI agents, contains an access control vulnerability in its webhook management feature. An authenticated user can request information about any webhook in the system by guessing or iterating through webhook IDs, discovering whether webhooks exist and what OAuth provider they use. In some cases, an attacker can also trigger webhook delivery events on behalf of another user. The vulnerability requires authentication but allows horizontal privilege escalation—a user with legitimate access can probe other users' integrations.

• CVE-2026-57291MEDIUM 5.4

  The Jenkins Gitee Plugin contains a flaw where permission validation is insufficiently enforced when users attempt to connect to external URLs with stored credentials. An attacker with basic read-level access to a Jenkins instance can exploit this gap to redirect plugin operations to a URL of their choosing and supply credential identifiers they've obtained through separate means. This allows credential reuse or exposure in unintended contexts without proper authorization checks.

• CVE-2026-57292MEDIUM 5.4

  Jenkins Gitee Plugin versions up to and including 1288.v18b_deb_c9069b_ contain a cross-site request forgery (CSRF) vulnerability that allows authenticated attackers to force actions on the Jenkins instance without explicit user consent. Specifically, an attacker can trick a logged-in Jenkins administrator or user into unknowingly establishing a connection to an attacker-controlled URL using credentials that the attacker has identified. The vulnerability requires the attacker to already know valid credential IDs within the target Jenkins instance, suggesting a multi-stage attack scenario.