{"schema":"threatline.record/2","record":{"id":"CVE-2026-115993","aliases":[],"summary":"Stored XSS in the “Notes” field of project checklists","details":"Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges","categories":["Unclassified"],"product":"cervantes","vendor":"CervantesSec","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115993","source_modified_at":"2026-10-24T08:32:46.940Z","fetched_at":"2026-10-24T10:48:42.330819Z","product":"cervantes","vendor":"CervantesSec","versions":[{"lessThanOrEqual":"1.3-beta","status":"affected","version":"alpha 0.3","versionType":"custom"},{"status":"unaffected","version":"v.1.4.0-beta"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00421,"percentile":0.35414,"score_date":"2026-10-24"},"published_at":"2026-10-24T08:32:46.940Z","modified_at":"2026-10-24T08:32:46.940Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115993","fetched_at":"2026-10-24T10:48:42.330819Z","source_modified_at":"2026-10-24T08:32:46.940Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115993","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.grayback.es/advisories","tags":["patch"]},{"source":"CVE List","url":"https://www.grayback.es/en/advisories","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-24T08:32:46.940Z","content_hash":"b5af8376164f7910936e287fa9d9e9c081f955015f28885b37ece0cdb37b5bfb"}}