CVE-2026-119274
Stored XSS attacks occur when an attacker injects a malicious script in Global Smart Folders feature in NIOS
CVSS
4.8
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 9 nov 2026 · Última mod.: 9 nov 2026 · CWE-20
Sin historial EPSS suficiente todavía.
Stored XSS attacks occur when an attacker injects a malicious script in Global Smart Folders feature in NIOS
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-842283.1 BAJ—
——0IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.21hCVE-2026-185254.9 MED—
——0IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.22hCVE-2026-1236135.3 MED4.7%
——1Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a plaintext EncryptedExtensions with the ServerHello, which rustls accepts unencrypted.2dCVE-2026-1235747.5 ALT28.1%
——8The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of service.2dCVE-2026-1235737.5 ALT28.1%
——8hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.2dCVE-2026-1187866.8 MED6.4%
——2Improper input validation in non-secure-callable (NSC)
veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example
(multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and
26.09.00 may allow a non-secure caller to supply unvalidated pointers and size
values, potentially resulting in disclosure of secure-world memory to the
non-secure domain, or denial of service. All software versions starting from
26.06.01-lts and 26.12.00-pvw1 have fixed this issue.3d