CVE-2026-4186General

LOWCVSS 2.0 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
General: 2 classified signals
Peaked 1d ago at 1 mentions (2026-03-15); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

General

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew207d
General
CVE-2026-4186 A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the component J… https://www.cve.org/CVERecord?id=CVE-2026-4186
Post summary
The tweet briefly announces CVE-2026-4186, noting its impact on UEditor up to version 1.4.3.2 and referencing file‑upload handling, but it provides no PoC, exploit, patch, or evidence of active exploitation.
00000114
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash207d
General
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4186 - UEditor JSONP Callback controller.php cross site scripting Intel Report: https://ift.tt/fFdbyvj
Post summary
The post alerts to a UEditor XSS flaw (CVE‑2026‑4186) with a link to an Intel report but provides no PoC, exploit, active‑use evidence, or mitigation details.
0000032
336 followersView on X

Explore more

Back to dashboard