Advisories · Weakness

Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-75711 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2025-64868 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75737 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75681 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-71356 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75696 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75701 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75724 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2025-64542 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75692 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75714 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75657 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2025-64588 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75736 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75693 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75670 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75717 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-79905 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75720 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-84942 CVE record

CVSS 6.3 Medium

Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
- AWS Amazon OpenSearch Service
- OpenSearch Dashboards
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-76002 CVE record

CVSS 6.1 Medium

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75993 CVE record

CVSS 8.5 High

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-69642 CVE record

CVSS 6.5 Medium

Skype for Business Spoofing Vulnerability
- Microsoft Skype for Business Server 2015 CU13
- Microsoft Skype for Business Server 2019 CU8
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-63523 CVE record

CVSS 6.5 Medium

Skype for Business Spoofing Vulnerability
- Microsoft Skype for Business Server 2015 CU13
- Microsoft Skype for Business Server 2019 CU8
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
prowler +1 PyPI

CVSS 5.4 Medium

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
- Cross-site scripting (XSS)
<5.37.0 · fixed in 5.37.0

GHSA-c2jg-2778-ggm4 · CVE-2026-73262 Not analysed yet 8 Sept 2026
CVE-2026-76200 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-76201 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
swc_html_minifier +1 crates.io

CVSS 6.1 Medium

SWC HTML minifier may allow script element breakout when minifying embedded JSON
- Cross-site scripting (XSS)
- CWE-116
<59.0.0 · fixed in 59.0.0

GHSA-5qr2-v392-m9g8 · CVE-2026-72925 Not analysed yet 8 Sept 2026
CVE-2026-81824 CVE record

CVSS 6.3 Medium

AVEVA Pipeline Integrity Monitor cross-site scripting
- AVEVA Pipeline Integrity Monitor
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-69615 CVE record

CVSS 3.5 Low

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-69417 CVE record

CVSS 7.3 High

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-69402 CVE record

CVSS 7.3 High

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-69690 CVE record

CVSS 4.6 Medium

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-69356 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Microsoft Exchange Server Spoofing Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-86668 CVE record

CVSS 5.3 Medium

aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
- aircheng-org iWebShop-5
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 8 Sept 2026
CVE-2026-86738 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- grokability snipe-it
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-86644 CVE record

CVSS 5.1 Medium

star7th showdoc API Page Save Endpoint editormd.js cross site scripting
- star7th showdoc
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 8 Sept 2026
CVE-2026-73319 CVE record

CVSS 5.1 Medium

XenForo < 2.3.13 XSS via Dynamic Redirect Handler
- XenForo
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-12230 CVE record

CVSS 6.4 Medium

LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-76931 CVE record

CVSS 6.4 Medium

Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
- dylanjkotze Zephyr Project Manager
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-86712 CVE record

CVSS 8.6 High

SiYuan before 3.8.2 Remote Code Execution via Clipboard
- siyuan
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-86550 CVE record

CVSS 6.5 Medium

UXSS vulnerability in ZTE browser products
- ZTE NebulaOS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-58113 CVE record

CVSS 8.5 High

Cross-site scripting in Siemens Teamcenter V2412 and others
- Siemens Teamcenter V2412
- Siemens Teamcenter V2506
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-81798 CVE record

CVSS 7.1 High

WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability
- Easy Appointments
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-84818 CVE record

CVSS 7.1 High

WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability
- 100plugins Open User Map
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-84817 CVE record

CVSS 7.1 High

WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetFormBuilder
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-84820 CVE record

CVSS 7.1 High

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-78997 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context…
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-78838 CVE record

CVSS 6.5 Medium

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's brow…
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-78742 CVE record

CVSS 6.1 Medium

Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction.
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-78741 CVE record

CVSS 6.1 Medium

Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature.
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-78738 CVE record

CVSS 6.1 Medium

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature.
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-52307 CVE record

CVSS 5.4 Medium

An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a cra…
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-86491 CVE record

CVSS 3.5 Low

Cross-site scripting in JetBrains YouTrack
- JetBrains YouTrack
- Cross-site scripting (XSS)
Not analysed yet 7 Sept 2026
CVE-2026-86484 CVE record

CVSS 4.6 Medium

Cross-site scripting in JetBrains YouTrack
- JetBrains YouTrack
- Cross-site scripting (XSS)
Not analysed yet 7 Sept 2026
CVE-2026-86483 CVE record

CVSS 5.4 Medium

Cross-site scripting in JetBrains YouTrack
- JetBrains YouTrack
- Cross-site scripting (XSS)
Not analysed yet 7 Sept 2026
CVE-2026-86440 CVE record

CVSS 5.1 Medium

MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
- MISP
- Cross-site scripting (XSS)
- CWE-20
Not analysed yet 7 Sept 2026
CVE-2026-6431 CVE record

CVSS 7.2 High

User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
Not analysed yet 7 Sept 2026
CVE-2026-78325 CVE record

CVSS 6.9 Medium

XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
- Standard Notes
- Cross-site scripting (XSS)
Not analysed yet 7 Sept 2026
CVE-2026-86301 CVE record

CVSS 5.1 Medium

code-projects Hospital Information System Patient Management editPatient.php cross site scripting
- code-projects Hospital Information System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 7 Sept 2026