CVE-2026-94402

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

• CWE-79

• https://www.ibm.com/support/pages/node/7291785

Published

Oct 20, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-94397Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-94398Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-94399Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-9440A vulnerability was identified in Edimax BR-6478AC 1.23. Aff…6.3
• CVE-2026-94400Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-94401MISP has a file-handling vulnerability that could let certai…8.3
• CVE-2026-94403A weakness has been identified in ColorFul iGameCenter 1.0.3…8.8
• CVE-2026-94404MISP has a security issue that could let an attacker change …7.1
• CVE-2026-94405Authorization Bypass Through User-Controlled Key vulnerabili…5.3
• CVE-2026-94408Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…4.9
• CVE-2026-9441A security flaw has been discovered in Edimax BR-6478AC 1.23…6.3
• CVE-2026-94410A low privileged remote attacker is able to view a list of r…4.3