Dashboard / CVE-2026-13083

CVE-2026-13083

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 49/100
Published: 2026-06-26 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: Required
S: Changed
C: High
I: Low
A: None

Description

A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
redhat pen_drive < 1.0.0-2

References & Advisories (2)

Bug Bounty Relevance

49 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

6.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

EPSS — Exploitation Probability

0.30%
Raw Score 0.003030
Percentile 23.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00303
2026-10-28
0.00303

Intelligence Sources

nvd ref →

External Links