CVE-2026-90497: Feng Office
- Severity
- 2 (LOW)
- Vendor
- MICROSOFT
- Affected versions
- 3.11.13.0; 3.11.13.1; 3.11.13.2
- Patch status
- Unknown
- Published
- 2026-09-13T06:16:25.980
- Modified
- 2026-09-13T06:16:25.980
Why it matters
Vulnerability requiring standard triage and vendor validation.
Recommended admin actions
- Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
- Treat internet-facing systems as higher priority.
Technical summary
A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
View the official NVD record for CVE-2026-90497
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-90558 |
sngrep
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-90561 |
strapi PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-90562 |
LangBot PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-90647 |
ASE2000 V2 Communication Test Set
Reporter: CVE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-90560 |
zstd-jni
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-90559 |
snappy-java
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90668 |
UnrealIRCd PATCH
Reporter: CVE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90770 |
spug
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90774 |
rustypaste PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90776 |
nodemailer PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90777 |
espnet PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90778 |
sipp
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90779 |
sipp
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90780 |
sipp
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-90768 EXPLOITED |
CAPEv2
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-90556 |
freeciv PATCH
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-90493 |
Internet Download Manager
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-90783 |
MKVToolNix PATCH
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-90769 |
open-notebook PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-90772 |
amundsen-frontend
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-90651 |
Socket Firewall PATCH
Reporter: CVE
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-90678 |
HAProxy PATCH
Reporter: CVE
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-86406 |
User Registration & Membership PATCH
Reporter: CONTACT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-89080 |
Really Simple Security PATCH
Reporter: CONTACT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-90616 |
Product identification pending PATCH
Reporter: CVE
|
7.4
HIGH
|
VIEW RECORD |
| CVE-2026-80071 |
User Registration & Membership PATCH
Reporter: CONTACT
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-90648 |
wabt
Reporter: CVE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-90767 |
Froxlor PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-90775 |
address_standardizer
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-90557 |
Product identification pending
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-90494 |
node-restify
Reporter: CNA
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-90513 |
api-lambda-send-email-ses
Reporter: CNA
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-90771 |
Product identification pending
Reporter: DISCLOSURE
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-90782 |
Product identification pending
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-90495 |
Feng Office
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90498 |
vhr
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90504 |
WARP-Clash-API
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90509 |
orion-visor
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90510 |
orion-visor
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90514 |
School Registration and Fee System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90515 |
School Registration and Fee System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90516 |
School Registration and Fee System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90517 |
Bank Locker Management System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90522 |
Tourism-Management-System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90523 |
Tourism-Management-System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90524 |
Tourism-Management-System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90526 |
School Registration and Fee System
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-90485 |
Uninstaller
Reporter: CNA
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-88764 |
Simple Membership PATCH
Reporter: CONTACT
|
5.4
MEDIUM
|
VIEW RECORD |
| CVE-2026-90486 |
openstatus
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-77773 |
Contact Form to Chat Apps | Click to Chat to Order PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-88995 |
Bookit — Booking & Appointment Calendar PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-90527 |
shiyi-blog
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-90528 |
tduck-platform
Reporter: CNA
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-90529 |
DataEase
Reporter: CNA
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-90563 |
bbs-springboot
Reporter: CNA
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-90781 |
Product identification pending
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-80072 |
User Registration & Membership PATCH
Reporter: CONTACT
|
4.7
MEDIUM
|
VIEW RECORD |
| CVE-2026-90679 |
Product identification pending
Reporter: CVE
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-88912 |
rtMedia for WordPress, BuddyPress and bbPress PATCH
Reporter: CONTACT
|
4.2
MEDIUM
|
VIEW RECORD |
| CVE-2026-86407 |
User Registration & Membership PATCH
Reporter: CONTACT
|
3.7
LOW
|
VIEW RECORD |
| CVE-2026-79300 |
sesam PATCH
Reporter: CVE
|
3.5
LOW
|
VIEW RECORD |
| CVE-2026-90773 |
procs
Reporter: DISCLOSURE
|
2.4
LOW
|
VIEW RECORD |
| CVE-2026-90487 |
xxl-job
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90488 |
xxl-job
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90490 |
vhr
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90491 |
gsubs
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90492 |
web_robot
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90499 |
vhr
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90500 |
vhr
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90501 |
vhr
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90507 |
WARP-Clash-API
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90511 |
OnlineBooks
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90518 |
Bank Locker Management System
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90519 |
Bank Locker Management System
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90520 |
Tourism-Management-System
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90521 |
Tourism-Management-System
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90525 |
Sales and Inventory System
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
| CVE-2026-90489 |
xxl-job
Reporter: CNA
|
2
LOW
|
VIEW RECORD |
| CVE-2026-90496 |
Feng Office
Reporter: CNA
|
2
LOW
|
VIEW RECORD |
| CVE-2026-90497 |
Feng Office
Reporter: CNA
|
2
LOW
|
VIEW RECORD |
| CVE-2026-90502 |
ServerStatus
Reporter: CNA
|
2
LOW
|
VIEW RECORD |
| CVE-2026-90503 |
Ludashi
Reporter: CNA
|
1.8
LOW
|
VIEW RECORD |
| CVE-2026-90508 |
Ludashi
Reporter: CNA
|
1.8
LOW
|
VIEW RECORD |
| CVE-2026-90505 |
WARP-Clash-API
Reporter: CNA
|
1.3
LOW
|
VIEW RECORD |
| CVE-2026-90506 |
WARP-Clash-API
Reporter: CNA
|
1.3
LOW
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.