CVE-2026-41043

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-915

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-410448.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broke CVE-2026-410457.0A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers authentic CVE-2026-410467.3A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious confi CVE-2026-410475.5Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise r CVE-2026-410487.1Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functi CVE-2026-410497.1Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to CVE-2026-41056.7A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation o CVE-2026-410509.9Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-CVE-2026-410515.0csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.CVE-2026-410528.8Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2 CVE-2026-410538.8Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principa CVE-2026-410547.8In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). Howe