Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL containing the ‘q’ parameter in ‘/search/index.html’. This vulnerability can be exploited to steal sensitive user information such as session cookies, or to perform actions while impersonating the user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-2736 Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a mal… https://www.cve.org/CVERecord?id=CVE-2026-2736
Post summary
The text discloses a reflected XSS vulnerability (CVE-2026-2736) in Alkacon's OpenCms v18.0, which permits attackers to execute arbitrary JavaScript through crafted URLs.
⚠️#INCIBEaviso | Múltiples vulnerabilidades en OpenCms de #Alkacon #CVE CVE-2026-2735 CVE-2026-2736 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-opencms-de-alkacon #AvisosDeSeguridad #TI #CNA #0day https://t.co/NpHFtcEZog
Post summary
Incibe issues a security alert detailing multiple CVEs (CVE-2026-2735 and CVE-2026-2736) affecting OpenCms, with a link to the advisory for further information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | alkacon | opencms | 18.0.0 | - | - |