CVE-2026-35466CWE-79

Stored XSS via unsanitized input from remote service

Medium · published April 2, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
15.7
In the wild
Unconfirmed
What it is

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-02T20:20Z
EPSS history
Timeline
  • 02 APR 20:20Z
    Stored XSS via unsanitized input from remote service
    cvelistv5