PT-2026-22127 · Touchvue+4 · Touchvue+4

Published 2026-02-26 · Updated 2026-03-12 · CVE-2026-1695

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PcVue versions 12.0.0 through 16.3.3

Description An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features. The issue exists on the error page of the OAuth server and may allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication. The vulnerable component is the OAuth server. The client id is involved in the authentication process.

Recommendations Update to a version later than 16.3.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1695

Affected Products

Pcvue

Snapvue

Touchvue

Web Schedule

Webvue

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1695 · Security Note
• https://pcvue.com/security/#SB2026-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1695 · Vendor Advisory
• https://t.me/cveNotify/155261 · Telegram Post
• https://t.me/cveNotify/153300 · Telegram Post
• https://t.me/CVEtracker/45835 · Telegram Post
• https://twitter.com/CVEnew/status/2027004190493446267 · Twitter Post
• https://twitter.com/dailycve/status/2032178496450023717 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027039533955424404 · Twitter Post