Vulnerabilities

TI-2025-27298 CVE-2025-40904 · GHSA-gm4f-wp2q-3rp4

HTML injection in Smart Polling in Guardian/CMC before 26.1.0

LOW 22

A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00186 Published 2026-05-19 Fixed in 26.1.0 CWE-79

TI-2025-27297 CVE-2025-40903 · GHSA-9pfj-vxgx-63wq

LOW 21

A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00194 Published 2026-05-19 Fixed in 26.1.0 CWE-79

TI-2025-27296 CVE-2025-40902 · GHSA-qhx5-6j68-67q4

LOW 21

A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00194 Published 2026-05-19 Fixed in 26.1.0 CWE-79

TI-2025-27295 CVE-2025-40901 · GHSA-m7v5-79cg-6pqf

LOW 21

A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00194 Published 2026-05-19 Fixed in 26.1.0 CWE-79

TI-2025-27294 CVE-2025-40900 · GHSA-36vw-4j29-fg6f

LOW 23

An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00201 Published 2026-05-19 Fixed in 26.1.0 CWE-1336