CVE-2026-115535 is a cross-site scripting (XSS) vulnerability in the gedelumbung HospitalManagement software. It affects the function sistem.php::simpan in the Settings Handler component, specifically through manipulation of the Title argument. The vulnerability can be exploited remotely and exploit code is publicly available. The product uses a rolling release strategy, so specific affected or fixed versions are not provided. The vendor has not yet responded to the issue report.
CVE-2026-115534 is a cross-site scripting (XSS) vulnerability in the gedelumbung HospitalManagement software affecting the Contact Form component. The flaw exists in the kirim function of application/modules/web/controllers/contact.php, where manipulation of input parameters such as nama, email, alamat, telepon, or pesan can lead to XSS. The vulnerability can be exploited remotely and public exploit code has been disclosed. The product uses a rolling release model, so specific affected or fixed versions are not available. No vendor response or patch has been reported yet.
Localstack version 4.9.2 contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted URL. This vulnerability has a CVSS score of 6.1, indicating a medium severity level. No fixed versions or patches are currently documented.
Mistune versions prior to 3.3.0 contain a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by using '../' sequences in include paths. Additionally, attackers can inject HTML through unescaped error messages and included file contents, enabling cross-site scripting (XSS) even when escape=True is set. This vulnerability is fixed in version 3.3.0.
Mistune versions before 3.3.0 contain a cross-site scripting (XSS) vulnerability in the Include directive. This flaw allows attackers who can place an HTML file readable by the renderer to execute stored scripts by referencing the file via an include directive combined with path traversal, when escape=False is set. The vulnerability is fixed in version 3.3.0.
CVE-2026-95717 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of ArubaOS (AOS) by Hewlett Packard Enterprise. It affects multiple versions of AOS and requires an authenticated attacker with high privileges to exploit. The vulnerability allows injection of malicious scripts that execute in the context of other authenticated users' browser sessions, potentially leading to unauthorized actions or data exposure. The CVSS score is 5.5, indicating a medium severity level.
Agent Zero versions prior to 1.15 contain a cross-site scripting (XSS) vulnerability in the Web UI. The application does not properly sanitize user input in chat messages or file uploads, allowing injected JavaScript to execute in the context of an authenticated user's session. This vulnerability is fixed in version 1.15.
OpenCATS versions from 0.10.0 up to but not including 0.12.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows low-privileged authenticated users to inject malicious HTML or JavaScript code into various name or title fields, which are then rendered unsanitized in the 'Recent' navigation panel on nearly every page. When other users, including administrators, view these records, the injected script executes in their sessions, potentially leading to session theft and privilege escalation. The vulnerability is fixed in OpenCATS version 0.12.0.
CVE-2026-61791 is a stored cross-site scripting (XSS) vulnerability in schorschii OCO-Server versions prior to 1.2.1. The vulnerability arises from improper neutralization of script in HTML attributes, specifically in the Html::commandButton() function which embeds a stored computer hostname into an inline JavaScript onclick handler without proper JavaScript escaping. An attacker with access to the shared agent-registration-key and with self-registration enabled can inject malicious script via a crafted hostname. This script executes in the context of an authenticated administrator, potentially allowing abuse of administrative privileges such as deploying software jobs. The issue is fixed in version 1.2.1.
CVE-2026-115246 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the patdocmsg.php file. It results from improper handling of the 'Query' argument, enabling remote attackers to execute script code. The vulnerability has been publicly disclosed with available exploit code, but no fix or response has been issued by the project. It has a medium severity rating with a CVSS 4.0 score of 5.1.
CVE-2024-58394 is a cross-site scripting (XSS) vulnerability in Retool versions before 3.88.0. It allows unauthenticated attackers to execute arbitrary JavaScript by proxying malicious SVG files through the /api/imageProxy endpoint. The vulnerability arises because the application serves attacker-controlled SVG content from its own origin without enforcing a Content Security Policy, enabling script execution in users' sessions. The flaw was first observed exploited in the wild by the Shadowserver Foundation on 2024-10-15. A fix is available in Retool version 3.88.0.
Splunk and SolarWinds released security updates addressing multiple vulnerabilities that could allow attackers to execute code, escalate privileges, cause denial-of-service, and leak sensitive information. Splunk patched critical improper access control and data exposure issues in Splunk Enterprise and SOAR, while SolarWinds fixed a high-severity broken authorization flaw in Observability and medium-severity XSS, SSRF, and information disclosure bugs. These updates resolve dozens of security defects across product code and third-party libraries.
Cisco released patches addressing 34 vulnerabilities across multiple products including Expressway Series, IOS XR, Snort 3, and Unified Communications. The vulnerabilities include critical remote code execution, authentication bypass, and cross-site scripting issues. Notably, a critical remote code execution flaw in Expressway Series could allow attackers to execute arbitrary commands as root. Other critical issues affect Unified Communications and Snort 3 products. Cisco is not aware of any active exploitation of these vulnerabilities in the wild.
CVE-2026-112313 is a high-severity stored cross-site scripting (XSS) vulnerability in ACF Extended versions before 0.9.2.8. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 0.9.2.8.
A stored cross-site scripting (XSS) vulnerability exists in WP Mailster through version 1.9.1.0. This vulnerability results from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 7.1.
A stored cross-site scripting (XSS) vulnerability exists in H5P through version 1.17.9 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No patch or remediation details are provided in the available data.