CVE-2026-66358

MediumCVSS 5.1/10Last modified Nov 9, 2026

Description

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Nov 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-66364.3A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file CVE-2026-663607.5The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check inCVE-2026-663628.1Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configCVE-2026-663646.5The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on theCVE-2026-663696.5The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame onCVE-2026-66378.8Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system uCVE-2026-663706.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticatedCVE-2026-663726.8The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seeCVE-2026-663737.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE paylCVE-2026-663748.1Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.CVE-2026-663758.1A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.CVE-2026-663765.4Credentials for a deleted user may remain valid for a short period under specific conditions.
CVE-2026-66358: Medium severity, CVSS 5.1 | Vulnix