CWE-80: Basic XSS vulnerabilities

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform HTML injection. This is due to improper neutralization of user-supplied input, which could lead to injection of script-related HTML tags.

CVE-2026-123840 is a medium severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows HTML injection in Remote Development editor tabs due to improper neutralization of script-related HTML tags. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Fileorbis Informatics Services Trade Inc. Fileorbis allows Using Malicious Files. This issue affects Fileorbis: before 12.5.4.

CVE-2026-111040 is a medium severity vulnerability in the Coupa Total Spend Management Platform that allows persistent HTML injection via editable fields managed by TinyMCE. An authenticated user with low privileges can inject unsanitized HTML content, which is stored in the database and rendered in other users' browsers, potentially affecting content display within the application.

The Jupiter X Core WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'forget_password_link' parameter. This flaw exists in all versions up to and including 4.61.0 and allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.

CVE-2026-112945 is a cross-site scripting (XSS) vulnerability in the Vite frontend tooling framework affecting versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. The flaw arises when applications using custom middleware pass an unchanged browser request URL to server.transformIndexHtml, allowing attacker-controlled module execution via crafted development-server pages. This can expose sensitive data or permit critical actions in the affected application. The issue has been fixed in the specified versions.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a vulnerability classified as CWE-80, involving improper neutralization of script-related HTML tags. This allows a remotely authenticated attacker to inject malicious HTML code that executes in the victim's browser within the context of the hosting site. The vulnerability has a CVSS 3.1 score of 5.4, indicating medium severity.

A cross-site scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery versions from 2012.2.710 up to but not including 2026.3.1015. The Validator component improperly decodes and parses validation messages from data-msg-* attributes as HTML, allowing an attacker who can modify these messages to execute arbitrary JavaScript in the user's browser. This can compromise confidentiality and integrity of data accessible to the affected application. The issue is fixed in version 2026.3.1015.

CVE-2026-106149 is a medium severity vulnerability in Progress Software Kendo UI for jQuery prior to version 2026.3.1015. The Menu component improperly neutralizes script-related HTML tags by constructing HTML attributes from bound dataSource fields via string concatenation without proper sanitization. This allows an attacker with low privileges who can control these fields to inject JavaScript event-handler attributes. The injected code executes when a user interacts with the affected Menu, potentially compromising confidentiality and integrity of data in the user's browser context.

CVE-2026-106148 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the TabStrip, Menu, and PanelBar components. These components improperly insert imageUrl values into single-quoted image src attributes without proper escaping, allowing attackers who can modify image URLs to inject HTML attributes and execute JavaScript in users' browsers. This vulnerability affects versions from 2011.2.804 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106147 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The issue exists in versions from 2020.1.114 up to but not including 2026.3.1015, where the ListBox default item template renders bound data as raw HTML without encoding. This allows an attacker who can control the bound data to inject HTML with event handlers that execute JavaScript in users' browsers. The vulnerability can lead to compromise of confidentiality and integrity of data accessible to the application. The issue is fixed in version 2026.3.1015.

CVE-2026-106161 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The Badge text method improperly renders string values as raw HTML without encoding, allowing injection of malicious scripts via data bound to a Badge. This vulnerability affects versions from 2020.1.114 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106159 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. It affects versions from 2022.3.1109 up to but not including 2026.3.1015. The issue arises because ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization, allowing an attacker to inject JavaScript via specially crafted URLs. This can lead to execution of malicious scripts in the user's browser when interacting with the affected buttons. The vulnerability is fixed in version 2026.3.1015.

CVE-2026-106158 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2014.3.1119 up to but not including 2026.3.1015. The issue occurs because resource color values are inserted into event wrapper attributes without proper encoding, allowing attackers who control these colors to inject malicious HTML attributes and JavaScript. This can lead to compromise of data confidentiality and integrity when users interact with affected events. The vulnerability has a medium severity with a CVSS score of 4.7 and is fixed in version 2026.3.1015.

A cross-site scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery's PanelBar component. Versions from 2019.2.514 up to but not including 2026.3.1015 improperly insert URL values into a single-quoted href attribute without proper encoding. This allows an attacker controlling the URL to inject HTML attributes and JavaScript, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106162 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery's FileManager component. Versions from 2023.3.1010 up to but not including 2026.3.1015 improperly render remotely supplied item names as HTML in drag hints, allowing injection of malicious scripts. This can lead to execution of JavaScript in a user's browser during drag operations, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106163 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the FileBrowser and ImageBrowser components. Versions from 2023.1.117 up to but not including 2026.3.1015 improperly render attacker-controlled file and directory names as HTML without proper encoding. This allows execution of arbitrary JavaScript in the user's browser, potentially compromising confidentiality and integrity of accessible data. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No official patch or remediation details are provided in the input data.

CVE-2026-108925 is a medium severity vulnerability involving improper neutralization of script-related HTML tags (basic cross-site scripting) in the Cohesity NetBackup Administration Console web interface. It affects versions prior to 11.2. The vulnerability allows an attacker to inject script code that could be executed in the context of the affected web interface. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the available data.

CVE-2026-106139 is a medium severity vulnerability in Progress Software Kendo UI for Vue where the default Chart tooltip renders formatted point values as raw HTML without encoding. This affects versions from 2.5.0 up to but not including 10.1.0. An attacker with low privileges who can control a string bound to the chart can inject HTML with event handlers that execute JavaScript when a user hovers over the data point, potentially compromising data confidentiality and integrity.

A cross-site scripting (XSS) vulnerability exists in Progress Software KendoReact versions 1.1.0 up to but not including 16.2.0. The default Chart tooltip renders formatted point values as raw HTML without encoding, allowing an attacker with low privileges who can influence chart-bound string values to inject HTML with event handlers. This can lead to JavaScript execution in the user's browser when hovering over the affected data point, potentially compromising data confidentiality and integrity.