CVE-2026-26027

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-116 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-260286.1CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be by CVE-2026-260297.5sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-serve CVE-2026-26038.1A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Pr CVE-2026-260309.9Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically CVE-2026-260315.3Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was i CVE-2026-260325.4The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. CVE-2026-260338.4UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) vulnerability, which CVE-2026-260348.5UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that allo CVE-2026-260359.8An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, For CVE-2026-26045.6A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D CVE-2026-260457.2A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during proce CVE-2026-260467.2A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow c