Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-13140

Stored Cross-Site Scripting in Canarytokens.org

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens
CVE-2026-12888

HTML injection in the Canarytoken Google Chat notification

An HTML injection vulnerability exists in the Google Chat webhook notification  sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens
CVE-2026-11859

HTML injection in the Canarytoken links email

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c0f3cf142 before sha-08c3f93d, from Git commit c0f3cf142 before 08c3f93d.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens
CVE-2026-10729

HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens