CVE-2026-42615

HighCVSS 7.2/10Last modified Jul 24, 2026

Description

GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Apr 29, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-426167.8In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscaCVE-2026-426177.1In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in thCVE-2026-426187.1In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of CVE-2026-42626.9Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parametCVE-2026-426265.9HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing).CVE-2026-426276.2In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model fileCVE-2026-426298.8Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.CVE-2026-42636.9Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parametCVE-2026-426307.5Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.CVE-2026-426317.1Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.CVE-2026-426327.1Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.CVE-2026-426338.5Subscriber SQL Injection in Events Manager <= 7.4.6 versions.
CVE-2026-42615: High severity, CVSS 7.2 | Vulnix