CVE-2026-18682

LowCVSS 3.1/10Last modified Aug 12, 2026

Description

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 3, 2026
Last modified: Aug 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-186838.8IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a CVE-2026-186849.8A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of CVE-2026-186859.8A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc o CVE-2026-186869.8A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/gl CVE-2026-186877.1MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the c CVE-2026-186887.1An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a CVE-2026-18696.5The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & L CVE-2026-186908.1An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected syst CVE-2026-186918.8An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authenticati CVE-2026-186928.8An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an int CVE-2026-186937.6An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal CVE-2026-186947.1An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed