{"action":"Upgrade org.apache.storm:storm-webapp to 2.8.6 or later.","affected":[{"fixed":"2.8.6","introduced":"0"}],"component":"org.apache.storm:storm-webapp","cve_ids":["CVE-2026-35565"],"ecosystem":"Maven","epss":0.00466,"exploited":false,"fixed_versions":["2.8.6"],"ghsa_id":"GHSA-f2hp-qw27-8wfq","id":"tcs_01M5N8TRGGQ7AWMG1FJG8YAXTV","modified_at":"2026-04-14T23:11:26.128680Z","published_at":"2026-04-13T12:31:15Z","references":["https://osv.dev/vulnerability/GHSA-f2hp-qw27-8wfq","https://nvd.nist.gov/vuln/detail/CVE-2026-35565","https://github.com/apache/storm","https://storm.apache.org/2026/04/12/storm286-released.html","http://www.openwall.com/lists/oss-security/2026/04/12/7"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-f2hp-qw27-8wfq","url":"https://osv.dev/vulnerability/GHSA-f2hp-qw27-8wfq"}],"summary":"Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata"}