CVE-2026-13083

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

• CWE-79

• https://access.redhat.com/security/cve/CVE-2026-13083Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2491886Issue Tracking, Vendor Advisory

Published

Jun 26, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13076An authenticated user can cause a {{mongod}} process to be t…7.1
• CVE-2026-13077A missing bounds check in the BSON CodeWScope element access…7.1
• CVE-2026-13078A vulnerability was discovered in MongoDB Server where the s…7.7
• CVE-2026-13079A local privilege escalation vulnerability in the WatchGuard…7.8
• CVE-2026-13080The WPFunnels – Funnel Builder for WooCommerce with Checkout…6.6
• CVE-2026-13082GD::SecurityImage versions through 1.75 for Perl use rand to…5.3
• CVE-2026-13084A null pointer dereference vulnerability in WatchGuard Firew…8.7
• CVE-2026-13089OIDC::Lite versions through 0.12.1 for Perl allow ID Token s…7.5
• CVE-2026-1310The Simple calendar for Elementor plugin for WordPress is vu…5.3
• CVE-2026-13103A potential path traversal vulnerability was reported in Len…7.3
• CVE-2026-13104A potential vulnerability was reported in Lenovo App Store, …7.3
• CVE-2026-1311The Worry Proof Backup plugin for WordPress is vulnerable to…8.8