https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T14:22:47.395002+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-210522 EUVD-2026-210522 2026-10-09T14:22:47.397466+00:00 EUVD-2026-210522 https://cve.radiocsirt.org/vuln/fkie_cve-2023-33197 fkie_cve-2023-33197 2026-10-09T14:22:47.397499+00:00

Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

 https://cve.radiocsirt.org/vuln/ghsa-6qjx-787v-6pxr GHSA-6qjx-787v-6pxr — Craft CMS stored XSS in indexedVolumes 2026-10-09T14:22:47.397530+00:00

Affected: Packagist: craftcms/cms

### Summary XSS can be triggered via the Update Asset Index utility

### PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "<script>alert(26)</script> 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes.

XSS will be triggered

Json response volumes name makes triggers the payload

"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},

It’s run on every POST request in the utility.

Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766

 https://cve.radiocsirt.org/vuln/gsd-2023-33197 gsd-2023-33197 2026-10-09T14:22:47.397568+00:00 gsd-2023-33197