CVE-2026-82546

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.

• CWE-79

• https://github.com/apache/roller/pull/178
• https://lists.apache.org/thread/ddrykzvs67zpmzwsbqyfjmlydboln8x1
• https://www.openwall.com/lists/oss-security/2026/09/25/21

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82540A vulnerability was identified in itsourcecode Sales and Inv…6.3
• CVE-2026-82541A security flaw has been discovered in itsourcecode Sales an…6.3
• CVE-2026-82542A weakness has been identified in Tenda HG10 300001138. Affe…10
• CVE-2026-82543A vulnerability was detected in vastsa FileCodeBox up to 2.3…7.3
• CVE-2026-82544A flaw has been found in wger-project wger up to 2.6.0-alpha…4.3
• CVE-2026-82545A vulnerability has been found in itsourcecode Sales and Inv…6.3
• CVE-2026-82547A vulnerability was found in Linux Foundation Magma 1.9.0. T…6.5
• CVE-2026-82548A vulnerability was determined in Linux Foundation Magma 1.9…5.3
• CVE-2026-82549A vulnerability was identified in Linux Foundation Magma 1.9…8.3
• CVE-2026-8255A weakness has been identified in Devs Palace ERP Online up …2.4
• CVE-2026-82550A security flaw has been discovered in Linux Foundation Magm…5.3
• CVE-2026-82551A weakness has been identified in Linux Foundation Magma 1.9…5.3