Johnson Controls Metasys 14

• CVE-2026-34491 Medium 6.1 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This iss 0.4%