CVE-2026-73262

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
prowler-cloud	prowler	< 5.37.0

References

Timeline

Published: Aug 12, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-732639.9Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a lega CVE-2026-732647.6Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an u CVE-2026-732656.5RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, an CVE-2026-732667.1A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerabil CVE-2026-732677.7A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and de CVE-2026-732689.9A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on Clu CVE-2026-732699.9A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming con CVE-2026-73278.1An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 1 CVE-2026-732708.2Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside CVE-2026-732734.3Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated CVE-2026-732768.3Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP CVE-2026-732789.8Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second fa