Is CVE-2026-109565 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109565?

CVE-2026-109565 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-109565

Description

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.