SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-90583

MEDIUM · CVSS 4.3 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-13 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

A cross-site scripting vulnerability exists in the Query String Rendering component of the affected F5 products, specifically within the index function of app/sw.py. This flaw allows remote attackers to manipulate the query string argument, potentially leading to unauthorized script execution in users' browsers. Organizations utilizing these products should prioritize applying the provided patch to mitigate the risk of exploitation, especially those with web-facing applications.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-90583
Severity
MEDIUM
CVSS
4.3
EPSS
0.28%
F5

Original NVD Description

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb. It is recommended to apply a patch to fix this issue. Exploitability requires a raw HTTP request carrying unencoded double-quote characters in the query string - Werkzeug's request.query_string returns the raw request-target, and ordinary browsers percent-encode " as %22, so the payload only lands via netcat/curl-style raw sockets.