Advisories · Weakness

Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-19810 CVE record

CVSS 5.4 Medium

Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console
- Broadcom Symantec Endpoint Detection and Response
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63168 CVE record

CVSS 5.1 Medium

Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass
- Omnispace Agora Project
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63157 CVE record

CVSS 5.1 Medium

Omnispace Agora Project < 26.10.0 Stored XSS via Links Module
- Omnispace Agora Project
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63156 CVE record

CVSS 5.1 Medium

Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter
- Omnispace Agora Project
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63148 CVE record

CVSS 5.1 Medium

Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename
- Omnispace Agora Project
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63147 CVE record

CVSS 5.1 Medium

Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name
- Omnispace Agora Project
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-103846 CVE record

CVSS 8.6 High

Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)
- Adobe Dimension
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-83960 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-83958 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-83662 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-48398 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110082 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110081 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110080 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110079 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110078 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110077 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110076 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110075 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110074 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110073 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110037 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-109415 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-107682 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-107305 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106633 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106632 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106631 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106630 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106629 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-106628 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager 6.5 LTS
- Adobe Experience Manager 6.5
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-86016 CVE record

CVSS 8.2 High

VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration
- vnote
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-70279 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Microsoft Exchange Server Spoofing Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-97783 CVE record

CVSS 8.1 High

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-88208 CVE record

CVSS 4.6 Medium

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-88209 CVE record

CVSS 4.6 Medium

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-88204 CVE record

CVSS 7.3 High

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-102864 CVE record

CVSS 4.6 Medium

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-102859 CVE record

CVSS 4.6 Medium

Microsoft Office SharePoint Spoofing Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110239 CVE record

CVSS 2.1 Low

Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
- zofe rapyd-admin
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110228 CVE record

CVSS 5.1 Medium

wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
- wallabag
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110224 CVE record

CVSS 5.1 Medium

QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
- Webkul QloApps
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110221 CVE record

CVSS 5.1 Medium

QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
- Webkul QloApps
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110219 CVE record

CVSS 5.1 Medium

QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
- Webkul QloApps
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-104816 CVE record

CVSS 8.5 High

Misskey: Cross-site scripting in RSS feed item links
- misskey
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-91013 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-92922 CVE record

CVSS 8.1 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-100133 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-92911 CVE record

CVSS 8.7 High

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Commerce
- Adobe Commerce B2B
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-104937 CVE record

CVSS 8.1 High

CVE-2026-104937
- Shopware
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110103 CVE record

CVSS 5.1 Medium

bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type
- mlogclub bbs-go
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-110101 CVE record

CVSS 5.1 Medium

Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads
- benjaminjonard Koillection
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-55562 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Cronicle: Stored XSS in admin Activity Log via account full_name field
- jhuckaby Cronicle
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-102982 CVE record

CVSS 8.5 High

Plane: XSS in work item comments
- plane
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-53711 CVE record

CVSS 5.1 Medium

MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI
- IBM mcp-context-forge
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-109960 CVE record

CVSS 8.7 High

Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
- froxlor
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-109744 CVE record

CVSS 8.1 High

Other issue in the DOM: File component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-78557 CVE record

CVSS 7.7 High

Cross-site scripting in Siemens Industrial Edge App Publisher
- Siemens Industrial Edge App Publisher
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63357 CVE record

CVSS 5.3 Medium

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63356 CVE record

CVSS 5.3 Medium

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026