CVE-2026-71189

LOWCVSS 3.5

Description

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

Timeline

Published:September 29th, 2026 10:18 PM

Last modified:September 30th, 2026 4:46 PM

CVSS Scoring

CVSS v3: 3.5 (LOW)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-79

References & Reports

Advisories, patches, and third-party reports

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02
https://www.toptech.com/blog/tms7-version-7-8-strengthens-security

Source: NIST NVD · Data may lag official sources by up to one minute