CVE-2026-28426

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.

• CWE-79

• https://github.com/statamic/cms/releases/tag/v5.73.11Release Notes
• https://github.com/statamic/cms/releases/tag/v6.4.0Release Notes
• https://github.com/statamic/cms/security/advisories/GHSA-5vrj-wf7v-5wr7Patch, Vendor Advisory

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28420Vim is an open source, command line text editor. Prior to ve…4.4
• CVE-2026-28421Vim is an open source, command line text editor. Versions pr…7.8
• CVE-2026-28422Vim is an open source, command line text editor. Prior to ve…2.2
• CVE-2026-28423Statmatic is a Laravel and Git powered content management sy…8.6
• CVE-2026-28424Statmatic is a Laravel and Git powered content management sy…6.5
• CVE-2026-28425Statmatic is a Laravel and Git powered content management sy…8
• CVE-2026-28427OpenDeck is Linux software for your Elgato Stream Deck. Prio…7.5
• CVE-2026-28428Talishar is a fan-made Flesh and Blood project. Prior to com…5.3
• CVE-2026-28429Talishar is a fan-made Flesh and Blood project. Prior to com…7.5
• CVE-2026-28430Chamilo LMS is a learning management system. Prior to versio…9.8
• CVE-2026-28431Misskey is an open source, federated social media platform. …7.5
• CVE-2026-28432Misskey is an open source, federated social media platform. …7.5