Vulnerability · Published Oct 26, 2026 · Assigned by ENISA

CVE-2026-70382Stored Cross-Site Scripting in Web Interface

Medium 4.1

In plain English

A medium-severity cross-site scripting in Cynap, Cynap Core, Cynap Pure SDM from WolfVision. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.

Affected products (as reported)

Vendor	Product	Versions
WolfVision	Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro	0 – before 1.78a
WolfVision	Cynap Pure (Next Gen), Cynap Bridge	0 – before 2.00d
WolfVision	Cynap Videobar	0 – before 1.72e
WolfVision	Cynap, Cynap Core, Cynap Pure SDM	0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L

References

https://wolfvision.com/de/security/cve-2026-70382-1 vendor-advisory