CVE-2026-75933

HighCVSS 7.3/10Last modified Oct 15, 2026

Description

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 21, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-759357.5Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial CVE-2026-759367.5Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actor CVE-2026-759379.4A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating CVE-2026-759397.4A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for si CVE-2026-75947.3A vulnerability was detected in Flux159 mcp-game-asset-gen 0.1.0. Affected is the function image_to_3d_async of the file src/index.ts of the CVE-2026-759409.1A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attack CVE-2026-759418.0A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allo CVE-2026-759432.6A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CL CVE-2026-759442.6A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently r CVE-2026-759452.6A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.CVE-2026-759468.2A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could p CVE-2026-759488.6Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `im