CVE-2026-21393

Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

• CWE-79

• https://jvn.jp/en/jp/JVN45405689/
• https://movabletype.org/news/2026/02/mt-906-released.html
• https://www.sixapart.jp/movabletype/news/2026/02/04-1100.html

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21385Memory corruption while using alignments for memory allocati…7.8
• CVE-2026-21386Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.1…4.3
• CVE-2026-21387Protection mechanism failure for some Intel(R) LLM Library f…5.4
• CVE-2026-21388Mattermost Plugins versions <=2.3.1 fail to limit the reques…6.5
• CVE-2026-21389An OS command injection vulnerability exists in XWEB Pro ve…8.8
• CVE-2026-2139A vulnerability was determined in Tenda TX9 up to 22.03.02.1…8.8
• CVE-2026-21399Heap-based buffer overflow for the Intel(R) Open Volume Kern…6.9
• CVE-2026-2140A vulnerability was identified in Tenda TX9 up to 22.03.02.1…8.8
• CVE-2026-21400Protection mechanism failure for some Intel(R) AI Reference …5.4
• CVE-2026-21404NAVTOR NavBox through version 4.16.1.20 contains hard-coded …6.3
• CVE-2026-21408beat-access for Windows version 3.0.3 and prior contains an …7.3
• CVE-2026-21409Improper authorization vulnerability exists in RICOH Streaml…8.2