CVE-2026-18516

CRITICAL 9.6

Improper Encoding or Escaping of Output in Crafty Controller

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

CWE	CWE-116
Vendor	arcadia technology, llc
Product	crafty controller
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for arcadia technology, llc crafty controller

Be the first to know when new critical vulnerabilities affecting arcadia technology, llc crafty controller are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Arcadia Technology, LLC / Crafty Controller

0 ≤ 4.10.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.com: https://gitlab.com/crafty-controller/crafty-4/-/work_items/743

Credits

Thank you to [0x90](https://0x90.sh/) on GitLab for reporting this issue.