CVE-2026-71881

CVSS 4.8 (medium) · published 2026-11-07

Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting

Weakness: CWE-79

Source: NVD CVE-2026-71881

References

• https://github.com/gbif/ipt/issues/3166
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0017.md

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.