Vulnerability · Published Oct 27, 2026 · Assigned by INCIBE
CVE-2026-117493Multiple vulnerabilities in Sisense’s Cloud BI Platform
High 8.3
In plain English
A high-severity cross-site scripting in Cloud BI Platform from Sisense. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 4.0)8.3High
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could compromise the confidentiality of the information accessible in that context.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sisense | Cloud BI Platform | 0 – before 27/10/2026 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L