CVE-2026-73262

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.

• CWE-79

• https://github.com/prowler-cloud/prowler/commit/6db407ed3c17d4c73a8f619fdb30580c8465027f
• https://github.com/prowler-cloud/prowler/pull/12221
• https://github.com/prowler-cloud/prowler/releases/tag/5.37.0
• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4

Published

Aug 12, 2026

Last Modified

Aug 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73247Kestra is an open-source, event-driven orchestration platfor…8.6
• CVE-2026-73248calibre is an e-book manager. Prior to 9.12.0, calibre proce…8.5
• CVE-2026-73249calibre is an e-book manager. Prior to 9.12.0, the calibre C…7.5
• CVE-2026-7325Improper authorization in the Active Directory browsing feat…7.1
• CVE-2026-73250Notepad++ is a free and open-source source code editor. Prio…5.4
• CVE-2026-7326A cross-site request forgery vulnerability in the Admin UI o…7.5
• CVE-2026-73263Prowler is a cloud security platform. Prior to 5.36.0, the K…9.9
• CVE-2026-73264Prowler is a cloud security platform. Prior to 5.33.1, an au…7.6
• CVE-2026-73265RustFS is a distributed object storage system built in Rust.…6.5
• CVE-2026-7327An improper privilege management vulnerability in the REST A…8.1
• CVE-2026-7328Missing authorization in Caliptra Core Runtime Firmware (INV…6.8
• CVE-2026-73281In ssh-agent in OpenSSH before 10.5, some operations can occ…3.5