CVE-2026-27614 - Vulnerability Analysis
CriticalCVSS: 9.3Last Updated: February 25, 2026
Bugsink - Stored XSS
Overview
Bugsink < 2.0.13 contains a stored XSS caused by unsanitized JavaScript in event stacktrace rendering, letting unauthenticated attackers execute scripts in admin browsers, exploit requires event submission and admin viewing.
Severity & Score
Impact
Attackers can execute JavaScript in admin browsers, potentially leading to full admin privilege compromise within Bugsink.
Mitigation
Update to version 2.0.13 or later.
References
Social Media Activity(2 posts)
š“ CVE-2026-27614 - Critical (9.3) Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the ... š https://www.thehackerwire.com/vulnerability/CVE-2026-27614/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postš“ CVE-2026-27614 - Critical (9.3) Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an unauthenticated attacker who can submit events to a Bugsink project can store arbitrary JavaScript in an event. The payload executes only if a user explicitly views the ... š https://www.thehackerwire.com/vulnerability/CVE-2026-27614/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-27614
- Severity
- Critical
- CVSS Score
- 9.3
- Type
- stored_xss
- Status
- unconfirmed
- EPSS
- 8.8%
- Social Posts
- 2
CWE
- CWE-79
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N