CVE-2026-81814

MediumCVSS 5.1/10Last modified Aug 28, 2026

Description

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.

The fix changes:

titleEl.innerHTML = arg.event.title

to:

titleEl.textContent = arg.event.title || ''

and similarly stops using innerHTML for the static download icon.

Version impacted =>3.3.0

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-818177.2Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task en CVE-2026-818188.6Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correct CVE-2026-818195.3Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id par CVE-2026-81828.8IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credent CVE-2026-818205.1Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * CVE-2026-818218.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive informati CVE-2026-818228.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ ap CVE-2026-818235.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resu CVE-2026-818244.7The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was s CVE-2026-818257.2The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all CVE-2026-818269.1Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an atta CVE-2026-818276.9Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForm