CVE-2026-60043

An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.

• CWE-79

• https://www.certvde.com/en/advisories/VDE-2026-079/
• https://www.certvde.com/en/advisories/VDE-2026-141/

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-60038A high privileged remote attacker can perform an OpenSSL cod…7.2
• CVE-2026-60039A high privileged remote attacker can perform a code injecti…7.2
• CVE-2026-6004A vulnerability was detected in code-projects Simple IT Disc…7.3
• CVE-2026-60040An unauthenticated remote attacker can perform a DoS in the …7.5
• CVE-2026-60041An unauthenticated remote attacker can perform a CSRF attack…8.1
• CVE-2026-60042An unauthenticated remote attacker can perform an authentica…5.3
• CVE-2026-60044The backups created by the application use a weak static pas…7.5
• CVE-2026-60045A high privileged remote attacker can upload arbitrary files…4.9
• CVE-2026-60046An unauthenticated remote attacker can perform password rese…7.5
• CVE-2026-6005A flaw has been found in code-projects Patient Record Manage…6.3
• CVE-2026-60053Insufficient Session Expiration vulnerability in Apache Answ…9.1
• CVE-2026-60059Use of uninitialized resource in the MigTD memory for the In…4.8