CVE-2026-114404

Published 21 October 2026 · tracked since 22 October 2026

Description

PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-76462 MEDIUM 5.5
• CVE-2026-20236 HIGH 7.5
• CVE-2026-20291 HIGH 7.8
• CVE-2026-20356 HIGH 7.5
• CVE-2026-20043 CRITICAL 9
• CVE-2026-20179 MEDIUM 5.8
• CVE-2026-20197 MEDIUM 5.8
• CVE-2026-20218 MEDIUM 5.8
• CVE-2026-20221 MEDIUM 5.8
• CVE-2026-20011 MEDIUM 5.8

→ Open the live CVE board · all tools