https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:19:04.902344+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-358871 EUVD-2026-358871 2026-10-03T09:19:05.001620+00:00 EUVD-2026-358871 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34491 fkie_cve-2026-34491 2026-10-03T09:19:05.001658+00:00

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting.

This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-2fj7-6j2c-3972 GHSA-2fj7-6j2c-3972 2026-10-03T09:19:05.001694+00:00

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting.

This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

 https://cve.radiocsirt.org/vuln/icsa-26-225-14 ICSA-26-225-14 — Johnson Controls Metasys 2026-10-03T09:19:05.001713+00:00

A low-privilege user can inject a malicious XSS payload into the Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators.