{"schema_version": "1.6.1", "id": "CVE-2026-85229", "summary": "CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)", "details": "** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI.\n\n\n\nThis issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0.\n\n\n\nUsers are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "10.2.0"}, {"last_affected": "10.2.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/oswo0kxr7g2jgdoz3wd923nslo36jsv8"}]}