Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-95812
MacWarrior clipbucket-v5 — ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N N P L L N 5.3 .0035 26.9 —
AFFECTED
Product Versions Fixed
clipbucket-v5 unspecified 5.5.3-#182
TIMELINE
Sep 22 Reserved by VulnCheck
Sep 22 Published (CNA: VulnCheck)
Sep 23 EXPLOIT PUBLISHED — CVE-2026-95812 (MacWarrior clipbucket-v5). Public exploit reference added.
Description
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 22, 2026 | Reserved | Reserved by VulnCheck |
| September 22, 2026 | Published | Published (CNA: VulnCheck) |
| September 23, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-95812 (MacWarrior clipbucket-v5). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| MacWarrior | clipbucket-v5 | — | — | 5.5.3-#182 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-95812 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
