CVE-2026-27937

LOW EPSS 4.0%
Published Apr 21, 20262mo ago · Modified Jun 17, 20261w ago
3.1 CVSS 3.1
Low
Find Similar
Published Apr 21, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. This vulnerability is fixed in 3.7.16 and 4.1.16.

CVSS Details

Base Score
3.1
Exploitability
1.6
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
4.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

References 1

  • github.com https://github.com/octobercms/october/security/advisories/GHSA-jj38-h5w5-mvpf

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.