CVE-2026-117493

HighCVSS 8.3/10Last modified Nov 6, 2026

Description

Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an authenticated user with the Designer or Administrator role to execute JavaScript code in the browser of another user who opens the dashboard, via HTML or JavaScript code inserted into BloX widget fields, such as ‘desc’ and ‘text’.

Metrics

CVSS 4.0 8.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Sisense	Cloud BI Platform	< 27/10/2026

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sisenses-cloud-bi-platform

Timeline

Published: Oct 27, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1174993.7@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that r CVE-2026-11757.5A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component Gr CVE-2026-1175007.5HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every fi CVE-2026-1175017.5HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, use CVE-2026-1175035.3A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component CVE-2026-1175045.3A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/d CVE-2026-1175054.3A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the compon CVE-2026-1175064.3A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setIn CVE-2026-1175075.4A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. Th CVE-2026-1175096.3A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/pers CVE-2026-117519.1A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabl CVE-2026-1175106.3A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbo