By weakness (CWE)

CWE-87: related vulnerabilities

CVEs classified under CWE-87. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

3 published vulnerabilities

• CVE-2026-55237HIGH 8.8

  AutoGPT versions before 0.6.62 contain a DOM-based cross-site scripting (XSS) vulnerability in the signup page. An attacker can craft a malicious link that tricks an authenticated user into clicking it, then executes arbitrary JavaScript in the victim's browser. This happens because the application unsafely uses a URL parameter called `next` to redirect users without properly validating it. Once the attacker's code runs, they could steal login credentials, access internal systems, or perform actions as if they were the victim.

• CVE-2026-46492HIGH 7.2

  md-fileserver is a tool for viewing markdown files directly in a web browser. Before version 1.10.3, the application failed to sanitize HTML tags embedded within markdown content. An attacker could craft a markdown file containing malicious JavaScript (such as in a <script> tag) that would execute when the file is viewed in the browser. This allows arbitrary code execution in the security context of the affected domain, potentially compromising user sessions or stealing sensitive data.

• CVE-2026-25688MEDIUM 6.1

  Apache Answer versions through 2.0.0 contain a cross-site scripting (XSS) vulnerability in how AI-generated response content is displayed to users. When Answer generates responses using AI, the application fails to properly clean this content before showing it in the browser. This allows an attacker to inject malicious scripts that execute in a user's browser when they view the generated response. The vulnerability requires user interaction (clicking a link or viewing a page with the malicious content) but can affect multiple users if the generated response is shared or cached.