CVE-2026-80180

MediumCVSS 6.1/10Last modified Sep 8, 2026

Description

Stored XSS via markdown HTML processing in Apache Allura.

This issue affects Apache Allura: from through 1.20.0.

Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Apache Software FoundationApache Allura<= 1.20.0

References

Timeline

Published
Sep 4, 2026
Last modified
Sep 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-801819.1Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. UserCVE-2026-801827.6In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could cCVE-2026-801837.1In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignmentCVE-2026-801847.6In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials,CVE-2026-801855.7BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corruCVE-2026-801867.6A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range CVE-2026-801896.5LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_eCVE-2026-80195.4Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a craCVE-2026-801906.1Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.  The vulnerability is likely mitigated CVE-2026-801917.5GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmenCVE-2026-801928.1@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownCVE-2026-801938.8Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authentic
CVE-2026-80180: Medium severity, CVSS 6.1 | Vulnix