CVE-2026-4418CWE-80
CVE-2026-4418
Medium · published October 19, 2026
What it is
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
The record
Technical detail
- CVSS v3.1
- 5.4 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00226 · 12.6th percentile
- Weakness
- CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Published
- 2026-10-19T22:17Z
References (1)
EPSS history
Timeline