CVE-2026-3295

MediumCVSS 5.4/10Last modified Nov 6, 2026

Description

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Cloud Pak System	2.3.6.0; 2.3.6.1

References

https://www.ibm.com/support/pages/node/7290183

Timeline

Published: Oct 19, 2026
Last modified: Nov 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-329508.8SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection CVE-2026-329514.3Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2 CVE-2026-329527.5go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message CVE-2026-329534.6Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module CVE-2026-329547.5ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable CVE-2026-329558.8SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow vulnerability in processing the redirect U CVE-2026-329569.8SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect UR CVE-2026-329575.3SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue on firmware mainten CVE-2026-329586.5SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to ap CVE-2026-329595.9SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. Inform CVE-2026-32969.8The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization CVE-2026-329606.5SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reu