CVE-2026-96878
Cargo Exhibit field alias allows stored XSS
CVSS score
6.9
EPSS probability
%0.3
Risk score
0.0
Published
20 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
Sanitized Cargo report and patch verification notes for CVE-2026-96878.
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2026-103044
EasyTimeline should not serve image maps as application/xml
TW
Patch verifiedEPSS %0
7.4
CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
TW
Patch status unknownEPSS %0
7.2
CVE-2026-103441
Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
TW
Patch status unknownEPSS %0
7.2
CVE-2026-103442
MergeAccount PHP object injection via session-key substitution
TW
Patch status unknownEPSS %0
6.9
CVE-2026-96877
Reflected XSS through Cargo Drilldown full-text search
TW
Patch status unknownEPSS %0
6.9
CVE-2026-96876
Anonymous reflected XSS in CargoExport invalid-alias errors
TW
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-96878"