Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-35466

Stored XSS via unsanitized input from remote service

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cert/cc Cmu
Products
Cveclient/cveinterface.js Cveclient
CVE-2026-35467

Private Key stored as extractable in browser IndexeDB

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cert/cc Cmu
Products
Cveclient/encrypt-storage.js Cveclient