CVE-2026-13140

LowCVSS 1.1/10Last modified Jun 25, 2026

Description

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens.

Anonymous exploitation requires knowledge of a random identifier.

This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

Metrics

CVSS 4.0 1.1/10CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 24, 2026
Last modified
Jun 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-131428.1The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockouCVE-2026-131435.3The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake beCVE-2026-131443.7The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on onCVE-2026-131454.3The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the cuCVE-2026-131463.7The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slipCVE-2026-131479.1The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated aCVE-2026-131486.3Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure. This issue affects smaCVE-2026-131497.7brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number oCVE-2026-13157.5By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before veCVE-2026-131506.9Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 PentestifyCVE-2026-131528.1The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writCVE-2026-131537.5The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a n
CVE-2026-13140: Low severity, CVSS 1.1 | Vulnix