CVE-2025-46657: Karaz Karazal

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.

Affected products

• Karaz Karazal: up to and including 2025-04-14

Published 2025-04-27. Last modified 2026-06-17.