Find a vulnerability

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Adobe heeft kwetsbaarheden verholpen in Adobe Experience Manager (versies 6.5.23 en eerder).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid bevindt zich in de wijze waarop invoer in formuliervelden wordt gesaneerd. Dit stelt aanvallers in staat om kwaadaardige JavaScript-code in te voegen. Wanneer andere gebruikers de aangetaste inhoud openen, worden de ge\u00efnjecteerde scripts uitgevoerd in hun browsers, wat kan leiden tot sessieovername, datadiefstal of andere kwaadaardige activiteiten. De kwetsbaarheid is het gevolg van onvoldoende invoersanering en uitvoer-encoding in de getroffen versies.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Adobe heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb26-24.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Adobe Experience Manager",
    "tracking": {
      "current_release_date": "2026-03-12T07:12:51.952931Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0090",
      "initial_release_date": "2026-03-12T07:12:51.952931Z",
      "revision_history": [
        {
          "date": "2026-03-12T07:12:51.952931Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Experience Manager (AEM)"
          }
        ],
        "category": "vendor",
        "name": "Adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27223",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27223 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27223.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27223"
    },
    {
      "cve": "CVE-2026-27224",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27224 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27224.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27224"
    },
    {
      "cve": "CVE-2026-27225",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27225 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27225.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27225"
    },
    {
      "cve": "CVE-2026-27228",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27228 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27228.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27228"
    },
    {
      "cve": "CVE-2026-27229",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27229 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27229.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27229"
    },
    {
      "cve": "CVE-2026-27230",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27230 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27230.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27230"
    },
    {
      "cve": "CVE-2026-27231",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27231 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27231.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27231"
    },
    {
      "cve": "CVE-2026-27232",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27232 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27232.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27232"
    },
    {
      "cve": "CVE-2026-27233",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27233 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27233.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27233"
    },
    {
      "cve": "CVE-2026-27234",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27234 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27234.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27234"
    },
    {
      "cve": "CVE-2026-27235",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27235 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27235.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27235"
    },
    {
      "cve": "CVE-2026-27236",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27236 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27236.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27236"
    },
    {
      "cve": "CVE-2026-27237",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27237 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27237.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27237"
    },
    {
      "cve": "CVE-2026-27239",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27239 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27239.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27239"
    },
    {
      "cve": "CVE-2026-27240",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27240 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27240.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27240"
    },
    {
      "cve": "CVE-2026-27241",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27241 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27241.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27241"
    },
    {
      "cve": "CVE-2026-27242",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27242 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27242.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27242"
    },
    {
      "cve": "CVE-2026-27244",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27244 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27244.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27244"
    },
    {
      "cve": "CVE-2026-27247",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27247 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27247.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27247"
    },
    {
      "cve": "CVE-2026-27248",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27248 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27248.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27248"
    },
    {
      "cve": "CVE-2026-27249",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27249 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27249.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27249"
    },
    {
      "cve": "CVE-2026-27250",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27250 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27250.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27250"
    },
    {
      "cve": "CVE-2026-27251",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27251 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27251.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27251"
    },
    {
      "cve": "CVE-2026-27252",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27252 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27252.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27252"
    },
    {
      "cve": "CVE-2026-27253",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27253 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27253.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27253"
    },
    {
      "cve": "CVE-2026-27254",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27254 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27254.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27254"
    },
    {
      "cve": "CVE-2026-27255",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27255 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27255.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27255"
    },
    {
      "cve": "CVE-2026-27256",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27256 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27256.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27256"
    },
    {
      "cve": "CVE-2026-27257",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27257 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27257.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27257"
    },
    {
      "cve": "CVE-2026-27262",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability that enables attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27262 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27262.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27262"
    },
    {
      "cve": "CVE-2026-27265",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27265 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27265.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27265"
    },
    {
      "cve": "CVE-2026-27266",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "description",
          "text": "Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious scripts into form fields, potentially executing harmful JavaScript in users\u0027 browsers.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27266 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27266.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27266"
    },
    {
      "cve": "CVE-2026-27227",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27227 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27227.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-27227"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Adobe Experience Manager (AEM) ist eine Content-Management-L\u00f6sung f\u00fcr die Erstellung von Websites, mobilen Anwendungen und Formularen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Adobe Experience Manager ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0667 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0667.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0667 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0667"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin APSB26-24 vom 2026-03-10",
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb26-24.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Adobe Experience Manager: Mehrere Schwachstellen erm\u00f6glichen Cross-Site Scripting",
    "tracking": {
      "current_release_date": "2026-03-10T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-11T08:46:32.660+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0667",
      "initial_release_date": "2026-03-10T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-10T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.5 LTS Service Pack 2",
                "product": {
                  "name": "Adobe Experience Manager \u003c6.5 LTS Service Pack 2",
                  "product_id": "T051558"
                }
              },
              {
                "category": "product_version",
                "name": "6.5 LTS Service Pack 2",
                "product": {
                  "name": "Adobe Experience Manager 6.5 LTS Service Pack 2",
                  "product_id": "T051558-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:experience_manager:6.5_lts_service_pack_2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Cloud Service \u003c2026.02",
                "product": {
                  "name": "Adobe Experience Manager Cloud Service \u003c2026.02",
                  "product_id": "T051559"
                }
              },
              {
                "category": "product_version",
                "name": "Cloud Service 2026.02",
                "product": {
                  "name": "Adobe Experience Manager Cloud Service 2026.02",
                  "product_id": "T051559-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:experience_manager:cloud_service__2026.02"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.5 Service Pack 24",
                "product": {
                  "name": "Adobe Experience Manager \u003c6.5 Service Pack 24",
                  "product_id": "T051560"
                }
              },
              {
                "category": "product_version",
                "name": "6.5 Service Pack 24",
                "product": {
                  "name": "Adobe Experience Manager 6.5 Service Pack 24",
                  "product_id": "T051560-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:experience_manager:6.5_service_pack_24"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Experience Manager"
          }
        ],
        "category": "vendor",
        "name": "Adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27223",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27223"
    },
    {
      "cve": "CVE-2026-27224",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27224"
    },
    {
      "cve": "CVE-2026-27225",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27225"
    },
    {
      "cve": "CVE-2026-27227",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27227"
    },
    {
      "cve": "CVE-2026-27228",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27228"
    },
    {
      "cve": "CVE-2026-27229",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27229"
    },
    {
      "cve": "CVE-2026-27230",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27230"
    },
    {
      "cve": "CVE-2026-27231",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27231"
    },
    {
      "cve": "CVE-2026-27232",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27232"
    },
    {
      "cve": "CVE-2026-27233",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27233"
    },
    {
      "cve": "CVE-2026-27234",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27234"
    },
    {
      "cve": "CVE-2026-27235",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27235"
    },
    {
      "cve": "CVE-2026-27236",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27236"
    },
    {
      "cve": "CVE-2026-27237",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27237"
    },
    {
      "cve": "CVE-2026-27239",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27239"
    },
    {
      "cve": "CVE-2026-27240",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27240"
    },
    {
      "cve": "CVE-2026-27241",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27241"
    },
    {
      "cve": "CVE-2026-27242",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27242"
    },
    {
      "cve": "CVE-2026-27244",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27244"
    },
    {
      "cve": "CVE-2026-27247",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27247"
    },
    {
      "cve": "CVE-2026-27248",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27248"
    },
    {
      "cve": "CVE-2026-27249",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27249"
    },
    {
      "cve": "CVE-2026-27250",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27250"
    },
    {
      "cve": "CVE-2026-27251",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27251"
    },
    {
      "cve": "CVE-2026-27252",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27252"
    },
    {
      "cve": "CVE-2026-27253",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27253"
    },
    {
      "cve": "CVE-2026-27254",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27254"
    },
    {
      "cve": "CVE-2026-27255",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27255"
    },
    {
      "cve": "CVE-2026-27256",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27256"
    },
    {
      "cve": "CVE-2026-27257",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27257"
    },
    {
      "cve": "CVE-2026-27262",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27262"
    },
    {
      "cve": "CVE-2026-27265",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27265"
    },
    {
      "cve": "CVE-2026-27266",
      "product_status": {
        "known_affected": [
          "T051560",
          "T051558",
          "T051559"
        ]
      },
      "release_date": "2026-03-10T23:00:00.000+00:00",
      "title": "CVE-2026-27266"
    }
  ]
}