EUVD Vulnerability Catalog

EUVD-2026-70379

Severity: CRITICAL Base Score: 9.2 CVSS Version: 4.0

Vulnerability Description

A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other administrators access the template customisation view, allowing JavaScript code to be executed within the application’s security context and potentially compromising the sessions of other users with administrative privileges.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): High

▪ User Interaction (UI): Active

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): None

▪ Subsequent Confidentiality Impact (SC): High

▪ Subsequent Integrity Impact (SI): High

▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor OCS Inventory NG

References & Advisory Links

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

INCIBE

EPSS Probability

Known Aliases

CVE-2026-76178

Published On

2026-09-03

Last Updated

2026-09-03