CVE-2026-22919

Medium · 4.8

CVSS

4.8

EPSS

0.3%

Published

Jan 15, 2026

CISA due date

—

The record

An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensitive data.

Affected packages

Ecosystem	Package	Introduced	Fixed