CVE-2026-18478

MediumCVSS 5.1/10Last modified Oct 23, 2026

Description

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image.

The issue was fixed in version 6.3.10

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 10, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-18487.5Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number oCVE-2026-184808.8The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permissioCVE-2026-184817.3Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steCVE-2026-184829.8Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, wCVE-2026-184857.8There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver.  This may allow a local, authenticated CVE-2026-184868.8IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escCVE-2026-184875.4A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address CVE-2026-184886.4The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)CVE-2026-184897.4IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information frCVE-2026-18497.5MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises iCVE-2026-184908.8IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialCVE-2026-184956.1A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when p