Quick answers
- Is CVE-2026-12683 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12683 being exploited in the wild.
- How severe is CVE-2026-12683?
- Medium severity, with a CVSS score of 5.4, published 10 September 2026.
- Which products and versions are affected?
- Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 through 18.9.26.2318.
- Is there a fix for CVE-2026-12683?
- A patch was published on 2026-09-10: Fixed in version 18.9.26.2319 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12683 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-12683?
- Check whether you run Ankaref Innovation and Technology Inc. LIBRID/LIBREF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability resulting from improper neutralization of user-supplied input during web page generation. The vulnerability exists in LIBRID/LIBREF versions 2.01.0.2183 through 18.9.26.2318 and is fixed in 18.9.26.2319. An attacker can inject malicious HTML/JavaScript payloads that are persisted in the application and executed in the browsers of users who access the compromised content. No special privileges or user interaction beyond normal application use is required for exploitation, making this a network-accessible persistent XSS vector. Patch 18.9.26.2319 or later should be applied immediately.
Affected products
- Ankaref Innovation and Technology Inc. LIBRID/LIBREF 2.01.0.2183 through 18.9.26.2318
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 18.9.26.2319