Dashboard / CVE-2026-40028

CVE-2026-40028

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 50/100
Published: 2026-04-08 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
AT: None
VC: None
VI: None
VA: None

Description

Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scans JSON-exported logs containing malicious content in the Computer field. An attacker can inject JavaScript into the Computer field of JSON logs that executes in the forensic examiner's browser session when viewing the generated HTML report, leading to information disclosure or code execution.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Yamato-Security hayabusa 0

References & Advisories (3)

https://mobasi.ai/sentinel
vendor-advisory

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.21%
Raw Score 0.002080
Percentile 11.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00208
2026-11-12
0.00208
2026-11-10
0.00208
2026-11-09
0.00208
2026-11-08
0.00208

Intelligence Sources

mitre ref →

External Links