** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. …

Exploitation

none

Automatable

no

Technical impact

partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

1. Sep 4, 2026Published

   Disclosed via NVD

2. Sep 8, 2026Record revised

   Last analysed / modified upstream

3. Sep 8, 2026EPSS first tracked

   0.2%

4. Sep 8, 2026CVSS changed

   6.1 → —

5. Sep 8, 2026Severity changed

   medium → none

6. Sep 9, 2026CVSS changed

   — → 6.1

7. Sep 9, 2026Severity changed

   none → medium

8. Sep 9, 2026CVSS changed

   6.1 → —

9. Sep 9, 2026Severity changed

   medium → none

10. Sep 9, 2026CVSS changed

    — → 6.1

11. Sep 9, 2026Severity changed

    none → medium

12. Sep 9, 2026CVSS changed

    6.1 → —

13. Sep 9, 2026Severity changed

    medium → none

14. Sep 9, 2026CVSS changed

    — → 6.1

15. Sep 9, 2026Severity changed

    none → medium

16. Sep 25, 2026EPSS peak

    0.2% → 0.3%

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 6.1
• Sep 9, 2026Severity none → medium
• Sep 9, 2026CVSS 6.1 → —
• Sep 9, 2026Severity medium → none
• Sep 9, 2026CVSS — → 6.1
• Sep 9, 2026Severity none → medium
• Sep 9, 2026CVSS 6.1 → —
• Sep 9, 2026Severity medium → none
• Sep 9, 2026CVSS — → 6.1
• Sep 9, 2026Severity none → medium
• Sep 8, 2026CVSS 6.1 → —
• Sep 8, 2026Severity medium → none