CVE-2026-68583

MediumCVSS 5.4/10Last modified Oct 23, 2026

Description

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-685848.6SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChi CVE-2026-685855.8SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root CVE-2026-685868.6SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBackli CVE-2026-685878.6SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction CVE-2026-685885.3In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has co CVE-2026-685896.7In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malic CVE-2026-68598.8A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This a CVE-2026-685905.3In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE h CVE-2026-685916.7In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if CVE-2026-68605.3A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name CVE-2026-68617.1A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Ve CVE-2026-68625.5A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length f