CVE-2026-14466

MediumCVSS 4.3/10Last modified Sep 8, 2026

Description

It’s possible to run a stored XSS in Stormshield’s web administration panel.

To exploit this vulnerability, a SNS administrator with appropriate permissions must inject  some malicious script in a group’s comments in the webservices administration interface.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-144687.7HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly eCVE-2026-14475.4The Mail Mint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19.2. This is due to CVE-2026-144706.5IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a CVE-2026-144718.1Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry befoCVE-2026-144726.4The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versionCVE-2026-144748.8A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire CVE-2026-144754.9The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameCVE-2026-144768.0A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in thCVE-2026-144787.8A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticatedCVE-2026-144795.5A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specifieCVE-2026-14487.2A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the comCVE-2026-144809.9OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The applicat