These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-73642 debrief based on CVE Program and NVD records. Dayforce ESS Excelity has a critical path traversal vulnerability allowing unauthenticated attackers to download arbitrary local files via manipulated file path parameters. The issue was fixed in version V4. Defenders should assess exposure, prioritize remediation, and verify inventory for affected versions.
Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4. Defenders responsible for Dayforce ESS Excelity instances, especially those with publicly accessible endpoints, should assess exposure and verify the effectivenes [truncated]
The CVE-2026-73640 vulnerability in Dayforce ESS Excelity's password recovery functionality allows an unauthenticated attacker to exploit a Time-Based Blind SQL Injection vulnerability. This issue was fixed in version V3. Defenders responsible for Dayforce ESS Excelity instances, especially those with unauthenticated access to the password recovery functionality, should assess exposure and prioritize veri [truncated]