TI-2026-76489 CVE-2026-112289 · GHSA-3rx2-qcp6-mwjpKoalixcrm Stored XSS via Task Title in Django AdminPriority MEDIUM 56Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task().CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00203 · Published 2026-10-19 · No fix listed CWE-79