CWE-79: Cross-site Scripting vulnerabilities

CVE-2026-102638 is a stored cross-site scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in the description of an electronic library (.lbr) file and displayed in the Library Manager after import. Exploitation can allow an attacker to read local files or execute arbitrary code within the context of the current process.

CVE-2026-102637 is a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. It occurs when a malicious HTML payload is injected into the documentName parameter of a Fusion protocol URL and invoked by a user. This flaw allows an attacker to execute arbitrary code or read local files within the context of the current process. The vulnerability affects versions from 2705.1.30 up to but not including 2706.1.14 and has been assigned a high severity score of 7.1. A fix is available in version 2706.1.14.

CVE-2026-102636 is a stored cross-site scripting (XSS) vulnerability in Autodesk Fusion desktop application. It occurs when a malicious HTML payload is embedded in a design name and triggered upon opening the manipulated design by another user. This vulnerability allows an attacker to execute arbitrary code or read local files within the context of the application process.

KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.

Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0.

The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin suffers from a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 3.9.6. This flaw allows unauthenticated attackers to inject malicious scripts that execute when any user views a page containing the injected comment. The vulnerability is notable because it affects even pending or unapproved comments, as the plugin does not filter comments by approval status when retrieving them.

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without authentication through com_ajax. The value was stored exactly as submitted instead of being taken from the connection by the server. It was then printed without output escaping in the administrator backend’s “Helpful articles” overview (views/items/tmpl/default.php). $db->quote() was applied on insert, which protects the SQL statement but does nothing for HTML output. There was no CSRF token, no rate limit, and the vote de-duplication keyed on the same attacker-controlled field.

Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an authenticated user with the Designer or Administrator role to execute JavaScript code in the browser of another user who opens the dashboard, via HTML or JavaScript code inserted into BloX widget fields, such as ‘desc’ and ‘text’.

The Analytics Insights – Google Analytics Dashboard for WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 6.3.12. This vulnerability arises from insufficient input sanitization and output escaping of the Page Title, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when any user accesses the compromised page, potentially leading to data theft or session hijacking.

CVE-2026-116836 is a Stored Cross-Site Scripting (XSS) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker with access to the adjacent network can exploit this flaw under certain conditions to escalate privileges on the device. The vulnerability affects versions prior to 6.3.26. A fix is available in version 6.3.26.

A cross-site scripting (XSS) vulnerability exists in the lxsmnsyc seroval library versions 1.6.0 through 1.6.10. The issue arises because the JavaScript-output APIs derive a typed array's constructor name from a property that can be attacker-controlled if untrusted properties are copied onto a typed array and then serialized. This allows execution of attacker-controlled JavaScript in the context of the page receiving the output. The vulnerability is fixed in version 1.6.11.

A Cross-site Scripting (XSS) vulnerability exists in the lxsmnsyc seroval library's JavaScript-output APIs prior to version 1.0.0 and from 1.5.5 up to but not including 1.6.10. The issue arises when serializing RegExp sources containing a less-than character without proper escaping for embedding in HTML script elements. This can allow an attacker to inject malicious scripts if untrusted input is serialized and embedded in a script element. The vulnerability is fixed in version 1.6.10.

CVE-2026-70382 is a cross-site scripting (XSS) vulnerability affecting multiple WolfVision Cynap devices. The flaw arises because some externally supplied values stored by the device are rendered in the web interface without proper output encoding. An attacker who can influence these stored values could cause script execution in the browser of a user who views the affected page. Exploitation requires both attacker control over a stored value and a user viewing the vulnerable page. The vulnerability has a medium severity rating with a CVSS score of 5.1.

CVE-2026-57196 is a reflected cross-site scripting (XSS) vulnerability in Asterisk's phone provisioning HTTP error pages. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. An unauthenticated attacker can exploit this vulnerability to steal an authorized user's AMI session cookie and impersonate that user, but only if the HTTP server, AMI, and AMI HTTP access are enabled and the attacker can convince the user to click a malicious link. By default, the HTTP server binds to 127.0.0.1, limiting exposure. The issue is fixed in the stated versions.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for impacted ArcGIS Server software in General Availability and Extended support status, which includes versions 11.5. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

A stored Cross-Site Scripting (XSS) vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2 allows an attacker to inject malicious scripts via HTML-type custom contact fields. The injected script executes when a user views the affected contact's detail page, potentially enabling administrative actions such as creating admin accounts or accessing sensitive data. This vulnerability has a high severity score of 8.2 and is fixed in version 7.2.2.

CVE-2026-4316 is a reflected Cross-Site Scripting (XSS) vulnerability in the Gym Management Software IsMyGym by Zuinq Studio. The flaw exists in the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser context. The vulnerability has a medium severity rating with a CVSS score of 5.1. No affected versions or patches are specified in the available data.