CVE-2026-44541

Description

ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

6.1 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Effective score

6.1 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-44541

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-35201

Assigner

GitHub_M

Published

Jun 8, 2026, 8:01:54 PM

Updated

Jun 9, 2026, 12:57:22 PM

EUVD base score (CVSS 4.0)

7.0 / 10
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

EUVD-reported EPSS

0.3000

Vendors

ethyca

Products

fides (2.33.0, < 2.84.5)

Aliases

GHSA-5qrq-9645-g5g2

ENISA description: Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-44541 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-44541 tenable:www.cve.org

• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 03:08 UTC
• CISA Warns of Microsoft Defender 0-Day Vulnerabilities Exploited in Attacks
  web:cybersecuritynews.com

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning organizations of active exploitation risks. The flaws, tracked as CVE - 2026 -45498 and CVE - 2026 -41091, impact Microsoft Defender and could allow attackers to disrupt systems or escalate privileges. Both ...

  2026-05-26 03:08 UTC
• Microsoft Issues Second Biggest Patch Tuesday Ever in April
  web:redmondmag.com

  Microsoft April 2026 Patch Tuesday fixed 163 CVEs , marking its second-largest security update. Three zero-day vulnerabilities impacted SharePoint, Chromium-based Edge workflows and Microsoft Defender.

  2026-05-26 03:08 UTC
• Microsoft Defender CVE-2026-41091 & CVE-2026-45498
  web:thecyberexpress.com

  Microsoft confirms active exploitation of CVE - 2026 -41091 and CVE - 2026 -45498 in Defender, with CVSS-rated risks, KEV listing, and urgent patches issued.

  2026-05-26 03:08 UTC
• Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
  web:thehackernews.com

  Microsoft has disclosed that a privilege escalation and a denial-of-service flaw in Defender has come under active exploitation in the wild. The former, tracked as CVE - 2026 -41091, is rated 7.8 on the CVSS scoring system. Successful exploitation of the flaw could allow an attacker to gain SYSTEM privileges. "Improper link resolution before file access ('link following') in Microsoft Defender ...

  2026-05-26 03:08 UTC
• CISA orders feds to patch BlueHammer flaw exploited as zero-day
  web:www.bleepingcomputer.com

  CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.

  2026-05-26 03:08 UTC
• February's Patch Tuesday release fixes 59 flaws ... - Computerworld
  web:www.computerworld.com

  Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

  2026-05-26 03:08 UTC
• Microsoft Defender vulnerabilities exploited in the wild (CVE-2026 ...
  web:www.helpnetsecurity.com

  Attackers are actively exploiting two Microsoft Defender vulnerabilities ( CVE - 2026 -41091 and CVE - 2026 -45498), Microsoft acknowledged.

  2026-05-26 03:08 UTC
• Microsoft Technical Security Notifications
  web:www.microsoft.com

  Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

  2026-05-26 03:08 UTC
• Microsoft confirms two major Defender security issues - TechRadar
  web:www.techradar.com

  Microsoft patches two actively exploited zero‑day flaws in Defender, tracked as CVE‑2026‑41091 (privilege escalation) and CVE‑2026‑45498 (denial of service) Updates were shipped ...

  2026-05-26 03:08 UTC

Only Available for Registered Users. Sign in to view.