CVE-2026-35467

—

CVSS 3.1

7.5 high

EPSS

<1%p14

Published

Apr 2, 2026 (Apr 2, 2026)

Modified

Jul 24, 2026

Description

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

Vendors: cmu
Products: cveclient
Weakness: CWE-522
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.