CVE-2026-25901

MediumCVSS 6.1/10Last modified Jul 24, 2026

Description

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-259036.6Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific CVE-2026-259045.8The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python coCVE-2026-259055.8The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use tCVE-2026-259067.8Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privCVE-2026-259077.5Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attackerCVE-2026-259087.8Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCCCVE-2026-259164.3Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.CVE-2026-259177.2Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execCVE-2026-259185.5unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-clCVE-2026-25927.7The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions CVE-2026-259205.5SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, a heap out-of-bounds read vulnerability exists in SumatraPDF's MOBI HCVE-2026-259219.3Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chai
CVE-2026-25901: Medium severity, CVSS 6.1 | Vulnix