CVE-2026-10729

1.2 lowEPSS 0.2%

Low (1.2). EPSS 0.2% chance of exploitation in the next 30 days.

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

Severity

CVSS 4.0

1.2 low

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/AU:N/RE:L/U:Green

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2026-06-03
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

References

https://github.com/thinkst/canarytokens/security/advisories/GHSA-hmjv-pj8j-8fg7

Check your stack JSON