CVE-2026-75626: spiderfoot 0 through 4.0

CVE-2026-75626. CVSS 3.1 base score 9.3 (CRITICAL, Vendor/CNA). EPSS 0.00331 (percentile 0.24916), scored 21-Oct-2026.

Affected technology

spiderfoot · 0 through 4.0
smicallef

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys. Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality and integrity impact as high; availability impact as none.

Published 23-Oct-2026 06:11 UTC

CWE: CWE-79
CCR priority: 37.3 /100 (P4)
CVSS 3.1: 9.3 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N · Vendor/CNA
EPSS: 0.00331 · percentile 0.2497 · 2026-10-22
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-23 06:11:59.600832+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-23 06:11:01.814928+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-75626.html