Cross-site Scripting - Attack Type

Related Threat Clusters

• CVE-2026-55879: Critical XSS Vulnerability in OpenReplay Leads to Account Takeover

  CVE-2026-55879 is a critical vulnerability affecting OpenReplay versions 1.24.0 to 1.25.0, allowing unauthenticated attackers to execute stored XSS in the dashboard. The flaw arises from the OpenReplay tracking SDK's…

  3 articles · Updated July 11, 2026
• Vibe Coding Tools Found to Generate Critical Security Flaws

  A study by security startup Tenzai revealed that popular vibe coding platforms produce insecure code, including critical vulnerabilities, when responding to common programming prompts. The assessment, conducted in…

  3 articles · Updated January 14, 2026
• Critical Vulnerabilities in Splunk Enterprise Expose Systems to Attacks

  Multiple high and critical vulnerabilities have been identified in Splunk Enterprise, allowing attackers to execute malicious scripts and exfiltrate sensitive data. The most severe vulnerability, CVE-2026-20253, has a…

  36 articles · Updated June 12, 2026
• Critical SPIP Vulnerabilities Discovered in Ubuntu 16.04 LTS

  Multiple vulnerabilities have been identified in the SPIP website engine affecting Ubuntu 16.04 LTS and its derivatives. These vulnerabilities include cross site scripting (CVE-2022-28959), PHP injection…

  2 articles · Updated April 6, 2026
• CISA Warns of Active Exploitation of Ivanti EPM Vulnerability CVE-2026-1603

  CISA has identified a high-severity vulnerability in Ivanti Endpoint Manager (EPM), tracked as CVE-2026-1603, which is currently being exploited in attacks. The flaw allows remote threat actors to bypass authentication…

  1 article · Updated March 10, 2026
• SQL Injection Vulnerability in Elementor Ally Plugin Affects 250,000+ WordPress Sites

  A critical SQL injection vulnerability, tracked as CVE-2026-2313, has been discovered in the Ally WordPress plugin, which is used on over 400,000 sites. This flaw allows unauthenticated attackers to inject SQL commands…

  10 articles · Updated March 12, 2026
• SAP Patch Day Addresses Critical Vulnerabilities

  On March 10, 2026, SAP released 15 security notes, including two critical vulnerabilities that could allow remote code execution and system compromise. Administrators are urged to apply the patches promptly to protect…

  10 articles · Updated March 10, 2026
• Multiple Vulnerabilities in Microsoft Office Excel (CVE-2026)

  Microsoft Office Excel has multiple vulnerabilities that allow unauthorized attackers to execute code locally. These include an out-of-bounds read, use after free, untrusted pointer dereference, heap-based buffer…

  14 articles · Updated March 10, 2026
• Roundcube Webmail Vulnerabilities Expose Systems to Malware Attacks

  Roundcube Webmail has been found vulnerable due to eight security flaws, four of which are rated high severity (CVE-2026-48842, CVE-2026-48843, CVE-2026-48844, CVE-2026-48848). Attackers can exploit these…

  5 articles · Updated May 27, 2026
• Critical ESAPI Vulnerabilities Affect Multiple Ubuntu Releases

  Recent vulnerabilities in the ESAPI library have been identified, impacting several versions of Ubuntu, including 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS. The vulnerabilities include a control-flow…

  2 articles · Updated April 16, 2026

Recent Intelligence Reports

• CVE-2026-55879 - Exploits & Severity — Feedly · July 11, 2026
• Ubuntu SOGo Important Cross-Site Scripting SQL Injection USN-8504 — Linuxsecurity · July 6, 2026
• Fedora 44 python-postorius Critical Cross-Site Scripting CVE-2026 — Linuxsecurity · June 27, 2026
• Splunk Products Multiple Vulnerabilities — Hkcert · June 12, 2026
• Roundcube webmail instances attackable with malware — Heise.De · May 27, 2026
• How AI Increases the Load on Security Teams — Security · April 21, 2026
• CVE-2026-0868 - Exploits & Severity — Feedly · April 19, 2026
• CVE-2026-6493: lukevella rallly Reset Password reset-password-form.tsx cross site scripting [LOW] CVSS 3.5 Exploit Intelligence — Recent CVEs / 23h A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site s — exploit-intel.com · April 18, 2026

Related Entities