CVE-2026-96677

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

• CWE-79

• https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96671Cross-Site Request Forgery (CSRF) vulnerability in fifu.app …8.8
• CVE-2026-96672Frappe ERPNext versions before 16.34.1 fail to validate that…6.4
• CVE-2026-96673Photoview through 2.4.0 contains an SQL injection vulnerabil…7.5
• CVE-2026-96674alsa-lib through 1.2.16.1 computes combined topology element…4.4
• CVE-2026-96675alsa-lib through 1.2.16.1 contains a denial of service vulne…3.3
• CVE-2026-96676A vulnerability was identified in Fast FAC1900R 20190827_2.0…6.3
• CVE-2026-96678A security vulnerability has been detected in weiqingwen spr…6.3
• CVE-2026-9668With legitimate user credentials in hand, attackers can cons…6.3
• CVE-2026-96680A vulnerability was detected in ByteDance Coze Scraper Exten…4.3
• CVE-2026-96682The Presto Player plugin for WordPress is vulnerable to Stor…7.2
• CVE-2026-9669bz2.BZ2Decompressor objects could be reused after a decompre…8.2
• CVE-2026-9673Versions of the package json-2-csv from 3.15.0 and before 5.…6.8