CVE-2026-27655

MediumCVSS 4.8/10Last modified Jul 20, 2026

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 3, 2026
Last modified
Jul 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-276566.1Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in theCVE-2026-276577.5Gitea versions before 1.25.5 allow a user to change another user's primary email address.CVE-2026-276594.6Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /CVE-2026-27669.8Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, andCVE-2026-276607.5Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.CVE-2026-276614.3A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application leaks confidential informatiCVE-2026-276627.7Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in pCVE-2026-276636.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.CVE-2026-276647.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base system (All versions < VCVE-2026-276688.8A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (All versions < V5.8). User Administrators aCVE-2026-27679.8Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, anCVE-2026-276705.3OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outs