Skip to main content

Venueless CVE-2026-82838

| EUVDEUVD-2026-68392 MEDIUM
Basic XSS (CWE-80)
2026-08-31 655498c3-6ec5-4f0b-aea6-853b334d05a6
XSS Docker
6.4
CVSS 4.0 · Vendor: 655498c3-6ec5-4f0b-aea6-853b334d05a6
Share

Severity by source

Vendor (655498c3-6ec5-4f0b-aea6-853b334d05a6) PRIMARY
6.4 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Stored XSS requires low-privilege upload and passive viewer interaction; scope change reflects session-level impact on other authenticated users.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (655498c3-6ec5-4f0b-aea6-853b334d05a6).

CVSS VectorVendor: 655498c3-6ec5-4f0b-aea6-853b334d05a6

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

3
CVE Published
Aug 31, 2026 - 10:50 cve.org
MEDIUM 6.4
Patch available
Aug 31, 2026 - 09:01 EUVD
Analysis Generated
Aug 31, 2026 - 08:33 vuln.today

DescriptionCVE.org

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

AnalysisAI

Stored cross-site scripting in the Venueless default Docker image allows a low-privileged authenticated user to upload an SVG file containing executable JavaScript, which executes in the browser of any user who subsequently views the file. The root cause is absent Content Security Policy enforcement combined with unfiltered SVG delivery, classified as CWE-80. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold a low-privilege authenticated session on a Venueless instance running the unpatched default Docker image - any user role with file upload capability is sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.4 with subsequent-system impact metrics of SC:H/SI:H/SA:H indicates that while the attacker's direct impact on the serving system is limited (VC:L/VI:L/VA:N), the XSS payload can substantially affect other authenticated users - enabling session hijacking, credential theft, or privilege escalation depending on the role of the viewer. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The vendor has resolved this vulnerability by adding a valid Content Security Policy to the default Docker image, preventing browser execution of inline scripts within served SVG content. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Docker

View all
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2019-5736 HIGH POC
8.6 Feb 11

runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
CVE-2023-32077 HIGH POC
7.5 Aug 24

Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2023-5815 HIGH POC
8.1 Nov 22

The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
CVE-2026-66384 MEDIUM POC
5.3 Aug 12

Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
CVE-2014-9357 CRITICAL
10.0 Dec 16

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
CVE-2026-52806 CRITICAL POC
9.9 Jun 23

Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
CVE-2026-56274 HIGH POC
8.7 Jun 23

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
CVE-2026-34156 CRITICAL POC
9.9 Mar 30

Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
CVE-2019-15752 HIGH POC
7.8 Aug 28

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
CVE-2025-34221 CRITICAL POC
10.0 Sep 29

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2

Same weakness CWE-80 – Basic XSS

View all
CVE-2025-30210 HIGH POC
8.7
CVE-2025-30161 HIGH POC
8.4
CVE-2024-32484 HIGH POC
8.2
CVE-2026-2995 HIGH POC
7.7
CVE-2024-25639 HIGH POC
7.5
CVE-2022-0989 HIGH POC
7.5
CVE-2024-34507 HIGH POC
7.4
CVE-2024-33423 HIGH POC
7.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-82838 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy