Live › vulnerability › CVE-2026-4418
Go to dashboardIBM Cloud Pak System 2.3.6.0 and 2.3.6.1 fail to sanitize input, so HTML injected by an authenticated user is rendered. When another user views that content, the injected script runs in their browser within the hosting site's security context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running IBM Cloud Pak System 2.3.6.0 or 2.3.6.1. The attacker needs a valid account on the system, and a victim must view the injected content. The sources do not name a fix version or which pages are affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
This page as .md · .json · in your agent: get_signal("CVE-2026-4418")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.