CVE-2026-32774
Last modified
CVE-2026-32774 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Vulnogram | Vulnogram | 1.0.0 | Beta1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-32774?
How severe is CVE-2026-32774?
How do I fix CVE-2026-32774?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-32768Chall-Manager is a platform-agnostic system able to start Ch…9.9
- CVE-2026-32769Fullchain is an umbrella project for deploying a ready-to-us…9.8
- CVE-2026-3277The OpenID Connect (OIDC) authentication configuration in Po…6.5
- CVE-2026-32770Parse Server is an open source backend that can be deployed …7.5
- CVE-2026-32771The CTFer.io Monitoring component is in charge of the collec…9.8
- CVE-2026-32772telnet in GNU inetutils through 2.7 allows servers to read a…4.7
- CVE-2026-32775libexif through 0.6.25 has a flaw in decoding MakerNotes. If…7.8
- CVE-2026-32776libexpat before 2.7.5 allows a NULL pointer dereference with…5.5
- CVE-2026-32777libexpat before 2.7.5 allows an infinite loop while parsing …5.5
- CVE-2026-32778libexpat before 2.7.5 allows a NULL pointer dereference in t…5.5
- CVE-2026-3278Improper neutralization of input during web page generation …6.1
- CVE-2026-32788Uncontrolled search path for some Approximate Bayesian Infer…5.4
Are you affected by CVE-2026-32774?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST