CVE-2026-1031

MediumCVSS 6.1/10Last modified Sep 19, 2026

Description

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
IBMCommon LicensingAgent 9.0; Agent 9.0.0.1; Agent 9.0.0.2; ART 9.0; ART 9.0.0.1; ART 9.0.0.2

References

Timeline

Published
Sep 18, 2026
Last modified
Sep 19, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1031007.5Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigCVE-2026-1031017.5Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to CVE-2026-1031028.6Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to triggeCVE-2026-1031047.5Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a reCVE-2026-1031058.8Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacCVE-2026-1031067.8Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service thCVE-2026-1031087.5Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a reCVE-2026-1031099.4Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remCVE-2026-1031109.8Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute codeCVE-2026-1031117.6PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arCVE-2026-1031127.5A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system CVE-2026-1031134.7A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/stud
CVE-2026-1031: Medium severity, CVSS 6.1 | Vulnix