What’s Vulnerable › Vulnerabilities
CVE-2026-82838: Default webserver configuration with incorrect CSP
- Severity: medium (CVSS 6.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-31 · updated 2026-09-03
- Weakness: CWE-80
Description
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
References
Get alerted when CVE-2026-82838 or the next vulnerability affects your stack