Log in Start free

Vulnerability · Published Jul 27, 2026 · Assigned by TML

CVE-2026-15928

High 8.2

In plain English

A high-severity cross-site scripting in XMLRPC-C from XMLRPC-C. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8xmlrpc-c1.51.0-11.el8_10.1ALSA-2026:64772
AlmaLinux:9xmlrpc-c1.51.0-17.el9_8ALSA-2026:61316
AlmaLinux:8xmlrpc-c-c++1.51.0-11.el8_10.1ALSA-2026:64772
AlmaLinux:9xmlrpc-c-c++1.51.0-17.el9_8ALSA-2026:61316
AlmaLinux:8xmlrpc-c-client1.51.0-11.el8_10.1ALSA-2026:64772
AlmaLinux:9xmlrpc-c-client1.51.0-17.el9_8ALSA-2026:61316
AlmaLinux:8xmlrpc-c-client++1.51.0-11.el8_10.1ALSA-2026:64772
AlmaLinux:9xmlrpc-c-client++1.51.0-17.el9_8ALSA-2026:61316
AlmaLinux:8xmlrpc-c-devel1.51.0-11.el8_10.1ALSA-2026:64772
AlmaLinux:9xmlrpc-c-devel1.51.0-17.el9_8ALSA-2026:61316
Debian:12xmlrpc-cno fix listedDEBIAN-CVE-2026-15928
Debian:13xmlrpc-cno fix listedDEBIAN-CVE-2026-15928
Debian:14xmlrpc-cno fix listedDEBIAN-CVE-2026-15928
Rocky Linux:8xmlrpc-c0:1.51.0-11.el8_10.1RLSA-2026:64772
Rocky Linux:9xmlrpc-c0:1.51.0-17.el9_8RLSA-2026:61316
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-15928
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-15928

Affected products (as reported)

VendorProductVersions
XMLRPC-C XMLRPC-C 1.07 – through 1.67.011.07 – through 1.64.03

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References