PULSE
EN
FEED
ransompanzer reclama a Valode & Pistre · FR · Professional Servicesransompanzer reclama a Zenidoc · Professional Servicesransomn0n reclama a MarieBelle New York · US · Retail & E-Commerceransomn0n reclama a PG Group (Pure Options) · Financial Servicesransomemperador reclama a CMC AUDITORES SRL · AR · Professional Servicesransombyod reclama a Decorolala · Retail & E-Commerceransomaurora reclama a The Buckner Company, Inc. · US · Otherransomplay reclama a The Innovation Group · US · Otherransomplay reclama a DFK Group · DE · Professional Servicesransomplay reclama a Saddlers Court MFG · GB · Manufacturingransomplay reclama a Culinary Specialties · US · Agriculture and Food Productionransomplay reclama a Advanced Imaging Solutions · MN · Technologyransomorova reclama a The Park Lane Hong Kong · HK · Hospitalityransomorova reclama a Libre Wireless Technologies · IN · Technologyransompanzer reclama a Valode & Pistre · FR · Professional Servicesransompanzer reclama a Zenidoc · Professional Servicesransomn0n reclama a MarieBelle New York · US · Retail & E-Commerceransomn0n reclama a PG Group (Pure Options) · Financial Servicesransomemperador reclama a CMC AUDITORES SRL · AR · Professional Servicesransombyod reclama a Decorolala · Retail & E-Commerceransomaurora reclama a The Buckner Company, Inc. · US · Otherransomplay reclama a The Innovation Group · US · Otherransomplay reclama a DFK Group · DE · Professional Servicesransomplay reclama a Saddlers Court MFG · GB · Manufacturingransomplay reclama a Culinary Specialties · US · Agriculture and Food Productionransomplay reclama a Advanced Imaging Solutions · MN · Technologyransomorova reclama a The Park Lane Hong Kong · HK · Hospitalityransomorova reclama a Libre Wireless Technologies · IN · Technology
← Todos los CVEs
CVE Watch12 oct 2026

CVE-2026-105408

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec

CVSS

8.7

Alto

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 12 oct 2026 · Última mod.: 12 oct 2026 · CWE-79

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1088344.3 MED
—
——0A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-1054108.7 ALT
—
——0A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.1dCVE-2026-1054098.7 ALT
—
——0A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.1dCVE-2026-1088153.5 BAJ
13.9%
——4A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.1dCVE-2026-1081686.5 MED
4.7%
——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.1dCVE-2026-1078666.5 MED
4.7%
——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.1d