CVE-2026-40853

Not scored yetLast modified Nov 12, 2026

Description

A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont.

This issue affects Apache XML Graphics Batik: through 1.19.

Users are recommended to upgrade to version 1.20, which fixes the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-408548.7WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechaniCVE-2026-408559.3WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/CVE-2026-408567.1WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which isCVE-2026-408578.4WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechaniCVE-2026-408588.8The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache usingCVE-2026-408598.1Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying CVE-2026-40866.4The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributCVE-2026-408609.8JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObCVE-2026-408616.5A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server proCVE-2026-408637.5PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreaCVE-2026-408644.3JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protectiCVE-2026-408657.1Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee doc
CVE-2026-40853: Unscored | Vulnix