All vulnerabilities
CVE-2026-70382

Stored Cross-Site Scripting in Web Interface

WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.78aAlso 2.00d, 1.72eCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 1.78aCynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure ProCVE List
  • 2.00dCynap Pure (Next Gen), Cynap BridgeCVE List
  • 1.72eCynap VideobarCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.

Text from CVE List

Affected versions 4

  • Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Proaffected: all versions before 1.78aCVE List
  • Cynap Pure (Next Gen), Cynap Bridgeaffected: all versions before 2.00dCVE List
  • Cynap Videobaraffected: all versions before 1.72eCVE List
  • Cynap, Cynap Core, Cynap Pure SDMaffected: version unspecifiedCVE List

References 1