{"id":"CVE-2026-12862","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-12862","generatedAt":"2026-10-28T03:27:35.669Z","title":"This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.","description":"Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.","published":"2026-06-22T10:16:18.000Z","lastModified":"2026-10-25T23:10:00.000Z","status":"Deferred","sourceIdentifier":"655498c3-6ec5-4f0b-aea6-853b334d05a6","cvss":{"version":"4.0","score":5.1,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-148"],"affected":[],"epss":{"score":0.00382,"percentile":0.31971,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/venueless/venueless/security/advisories/GHSA-5hw3-655h-7m86","source":"655498c3-6ec5-4f0b-aea6-853b334d05a6"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12862","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}