CVE-2026-82838

6.4 mediumEPSS 0.4%

Medium (6.4). EPSS 0.4% chance of exploitation in the next 30 days.

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

Severity

CVSS 4.0

6.4 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-80
Published: 2026-08-31
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

References

https://github.com/venueless/venueless/security/advisories/GHSA-38wh-hqvm-xgfc

Check your stack JSON