CVE-2026-40201

MediumCVSS 5.4/10Last modified Oct 26, 2026

Description

@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
diplodoc-platform@diplodoc/search-extension>= 1.0.0, < 3.0.3

References

Timeline

Published
May 1, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-402033.7When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacCVE-2026-402043.1None None None No publicly available exploits are known.CVE-2026-402055.9An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is requiCVE-2026-402083.7An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.CVE-2026-402095.3An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediatCVE-2026-40218.1The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, CVE-2026-402104.8An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network CVE-2026-402115.3An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The bufCVE-2026-402125.4OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.wrCVE-2026-402137.4OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally authorCVE-2026-402146.3In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column CVE-2026-402157.4A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or
CVE-2026-40201: Medium severity, CVSS 5.4 | Vulnix