CVE-2026-70382
Medium
Description
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
SeverityMedium
CVSS4.1
Exploit probability—
ProductCynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
PublishedOct 26, 2026
First seenOct 26, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro1.78a or later
- WolfVision Cynap Pure (Next Gen), Cynap Bridge2.00d or later
- WolfVision Cynap Videobar1.72e or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro | v < 1.78a | 1.78a |
| WolfVision Cynap Pure (Next Gen), Cynap Bridge | v < 2.00d | 2.00d |
| WolfVision Cynap Videobar | v < 1.72e | 1.72e |
| WolfVision Cynap, Cynap Core, Cynap Pure SDM | 0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.