CVE-2026-73827: Cross-site scripting (XSS) in Tsuyoshi Saito SOY Calendar

CVE-2026-73827 is a cross-site scripting vulnerability in the SOY Calendar product by Tsuyoshi Saito. The flaw allows an attacker to execute arbitrary scripts in the context of a user who logs into the application. The CVSS 3.0 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality and integrity but not availability. No remediation level or patch information is currently available.

An attacker could execute arbitrary scripts in the browser of a logged-in user, potentially leading to partial compromise of confidentiality and integrity of user data within the application context. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content within the SOY Calendar environment.