CVE-2026-105410

{
  "etk_id": "ETK-2026-1347",
  "cve_id": "CVE-2026-105410",
  "display_id": "CVE-2026-105410",
  "ghsa_id": "GHSA-xq8v-jwc7-22xm",
  "euvd_id": "EUVD-2026-97329",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Tuleap Enterprise Edition",
  "summary": "Tuleap Enterprise Edition versions 17.0 through 17.5 are affected by a stored cross-site scripting flaw. An attacker may cause script to run in another user's browser session when that user views affected stored content. The advisory does not state whether authentication or another prerequisite is required.",
  "mitigation": "Restrict untrusted users from submitting content that will be displayed to other users, and review exposed stored content for injected scripts. Monitor for and apply a vendor update when one is released; no fixed version is recorded in the advisory.",
  "vendor": "Dassault Systèmes",
  "product": "Tuleap Enterprise Edition",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 17.0-1, <= 17.0-41",
        ">= 17.5-1, <= 17.5-32"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Tuleap Enterprise Edition",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
  "epss_score": 0.002,
  "epss_percentile": 0.097,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.3029316,
  "t0_at": "2026-10-12T10:45:09.518000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T10:45:09.518000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T10:45:09.518000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105410"
    }
  }
}