--- id: CVE-2026-15928 title: >- XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component. summary: >- XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component. severity: high cwe: - CWE-79 published: '2026-07-27' updated: '2026-07-27' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15928' references: - url: 'https://www.themissinglink.com.au/security-advisories/cve-2026-15928' label: vdp@themissinglink.com.au - url: 'https://xmlrpc-c.sourceforge.io/' label: vdp@themissinglink.com.au - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15928.json - url: 'https://access.redhat.com/security/cve/CVE-2026-15928' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507394' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-15928' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15928' - url: 'https://access.redhat.com/errata/RHSA-2026:61234' - url: 'https://access.redhat.com/errata/RHSA-2026:61231' - url: 'https://access.redhat.com/errata/RHSA-2026:61232' - url: 'https://access.redhat.com/errata/RHSA-2026:61315' - url: 'https://access.redhat.com/errata/RHSA-2026:61316' - url: 'https://access.redhat.com/errata/RHSA-2026:64772' - url: 'https://access.redhat.com/errata/RHSA-2026:61236' - url: 'https://access.redhat.com/errata/RHSA-2026:61233' - url: 'https://access.redhat.com/errata/RHSA-2026:61235' tags: - nvd - csaf - vex - red-hat ingestedAt: '2026-07-27T04:16:25.795Z' epss: 0.00283 epssPercentile: 0.21121 vendor: Red Hat product: Red Hat Enterprise Linux CRB (v. 8) affected: - enterprise_linux 6 - enterprise_linux_server_v_7_els - enterprise_linux_server_optional_v_7_els - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_eus_extension_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_crb_v_8 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 patched: - enterprise_linux_server_v_7_els - enterprise_linux_server_optional_v_7_els - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_eus_extension_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_crb_v_8 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 cvss: 7.4 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N' cvssSource: vendor --- ## Overview XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:61234** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61234) - **RHSA-2026:61231** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61231) - **RHSA-2026:61232** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61232) - **RHSA-2026:61315** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61315) - **RHSA-2026:61316** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61316) - **RHSA-2026:64772** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64772) - **RHSA-2026:61236** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61236) - **RHSA-2026:61233** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61233) - **RHSA-2026:61235** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61235) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15928.json)