CVE-2026-35466 identifies a Cross-Site Scripting (XSS) vulnerability (CWE-79) within the cveInterface.js component, where unsanitized HTML input from CVE API services is trusted and displayed. This flaw allows for remote HTML injection, carrying a FAUCET Risk Score of 27.0/100, though specific CVSS metrics are currently unavailable. There is no indication of active exploitation, nor is any public exploit code available on platforms like Metasploit or ExploitDB. Community attention is minimal, with only one recorded discussion mention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.24CPE matchmatch criteria | cpe:2.3:a:cmu:cveclient:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.