CVE-2026-18516

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18516
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18516.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18516
Published
2026-10-16T13:37:55Z
Modified
2026-10-17T02:48:20Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Improper Encoding or Escaping of Output in Crafty Controller
Details

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

Database specific 
{
    "cna_assigner":  "GitLab",
    "cwe_ids":  [
        "CWE-116"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18516.json"
}
References

Affected packages

Git / gitlab.com/crafty-controller/crafty-4

Affected ranges

Type
GIT
Repo
https://gitlab.com/crafty-controller/crafty-4
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
992f586ab6e158c5d8e2b27c1bbf17ca5689e99c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "4.10.8"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

4.*
4.0.0-alpha.3
v4.*
v4.0.0-alpha-3-hotfix.1
v4.0.0-alpha-3-hotfix.2
v4.0.0-alpha-3.5
v4.0.0-alpha.2
v4.0.0-beta
v4.0.0-beta-hotfix.1
v4.0.10-beta
v4.0.11-beta
v4.0.12-beta
v4.0.13-beta
v4.0.14-beta
v4.0.15-beta
v4.0.16
v4.0.18
v4.0.19
v4.0.2
v4.0.2-beta-hotfix.1
v4.0.20
v4.0.21
v4.0.22
v4.0.3-beta
v4.0.4-beta
v4.0.4-beta-hotfix2
v4.0.4-hotfix
v4.0.5-beta
v4.0.6-beta
v4.0.7-beta
v4.0.8-beta
v4.0.9-beta
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.10.0
v4.10.1
v4.10.2
v4.10.3
v4.10.4
v4.10.5
v4.10.6
v4.10.7
v4.10.8
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.3.0
v4.3.1
v4.3.2
v4.4.0
v4.4.1
v4.4.10
v4.4.11
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.4.9
v4.5.0
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.6.1
v4.6.2
v4.7.0
v4.8.0
v4.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18516.json"