CVE-2026-68567

HighCVSS 7.1/10Last modified Oct 22, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 18, 2026
Last modified
Oct 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-685686.3Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.CVE-2026-685698.1Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authCVE-2026-68577.5A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. ACVE-2026-685706.5Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not aCVE-2026-685718.8Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injeCVE-2026-685727.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 throughCVE-2026-685739.8Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin sCVE-2026-685787.5ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to CVE-2026-685799.6FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (clienCVE-2026-68587.1The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perCVE-2026-685807.5FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, anCVE-2026-685818.1Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are i
CVE-2026-68567: High severity, CVSS 7.1 | Vulnix