MEDIUM 6.1 NVD

CVE-2026-34491

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 1

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

References

https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Published: 2026-08-24 · Source: NVD · Feed updated: 2026-08-24

This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-08-24 via NVD.

vulnfeed aggregates 11313 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.