CVE-2026-35467

7.5 highEPSS 0.2%

High (7.5) in cmu cveclient. EPSS 0.2% chance of exploitation in the next 30 days.

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2026-04-02
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

cmu:cveclient

References

https://github.com/CERTCC/cveClient/
https://github.com/CERTCC/cveClient/pull/39

Check your stack JSON