Apache
CVE-2026-96677: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-
CVE-2026-96677 Nov 5, 2026 Source: Vendor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau.
HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applica
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-96677
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1 matching , clear filters
CVE-2026-96677
BR2026-0000-042534
unclaimed
Credited as 姬珏 (Diana Wang)