CVE-2026-48905

MediumCVSS 6.1/10Last modified Jul 20, 2026

Description

Lack of input filtering leads to an XSS vector in the HTML filter code.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-489068.1The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.CVE-2026-489079.8A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resuCVE-2026-489089.8A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload andCVE-2026-489099.5SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attCVE-2026-48915.3A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via aCVE-2026-489106.5A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, whicCVE-2026-489117.5Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing CVE-2026-489126.5Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in tCVE-2026-489137.3Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTPCVE-2026-489146.7A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors bCVE-2026-489166.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.CVE-2026-489176.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.
CVE-2026-48905: Medium severity, CVSS 6.1 | Vulnix