CVSS 9.6 (critical) · published 2026-10-16
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
Weakness: CWE-116
Source: NVD CVE-2026-18516
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.