Cwe-79 - Cross-site Scripting (xss) - Cwe

Related Threat Clusters

• Critical CVE-2026-48768 Vulnerability in TypeBot Exposes Users to File Upload Attacks

  A critical vulnerability, CVE-2026-48768, was disclosed affecting TypeBot versions 3.16.1 and earlier. The flaw allows unauthenticated users to exploit the POST /api/blocks/file-input/v3/generate-upload-url endpoint,…

  2 articles · Updated June 18, 2026
• Operation Escaneo Targets Latin American Critical Infrastructure

  Operation Escaneo is a coordinated cyberattack attributed to the MexicanMafia group, targeting critical infrastructure across Latin America, primarily Mexico. The campaign, which spanned from 2025 to 2026, utilized…

  4 articles · Updated June 18, 2026
• Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution

  SiYuan, an open-source personal knowledge management system, has disclosed a critical stored cross-site scripting (XSS) vulnerability that can escalate to remote code execution (RCE) in its Electron desktop client. The…

  7 articles · Updated June 25, 2026
• CVE-2026-55879: Critical XSS Vulnerability in OpenReplay Leads to Account Takeover

  CVE-2026-55879 is a critical vulnerability affecting OpenReplay versions 1.24.0 to 1.25.0, allowing unauthenticated attackers to execute stored XSS in the dashboard. The flaw arises from the OpenReplay tracking SDK's…

  3 articles · Updated July 11, 2026
• Critical SSTI Vulnerability in FOSSBilling Exposes Databases to RCE Attacks

  A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, was disclosed on June 23, 2026. This flaw affects all versions up to 0.7.2 and allows attackers to exploit unsafe…

  2 articles · Updated June 26, 2026
• Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign

  A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in a large-scale cyberattack affecting over 700 websites, including those of Harvard University, Oxford University, Auburn…

  17 articles · Updated May 25, 2026
• CISA Alerts on Critical Flaws in SimpleHelp, Samsung MagicINFO, and D-Link Devices

  On April 24, 2026, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The affected products include SimpleHelp remote management software, Samsung MagicINFO 9 Server, and…

  3 articles · Updated April 26, 2026
• Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress

  The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload, allowing Remote Code Execution in all versions up to 5.1.8. This vulnerability arises from insufficient file extension validation in the…

  9 articles · Updated July 3, 2026
• Chinese Threat Group Exploits Roundcube Vulnerabilities in University Networks

  A suspected China-aligned threat group, tracked as UNK_MassTraction, has been exploiting vulnerabilities in Roundcube mail servers at U.S. and Canadian universities since May 2026. The campaign targets physics and…

  13 articles · Updated July 7, 2026
• Critical RCE Vulnerability in Jenkins Exploited in the Wild

  A critical remote code execution (RCE) vulnerability, CVE-2026-53435, has been identified in Jenkins, affecting versions 2.567 and earlier, including LTS 2.555.2 and earlier. This flaw allows attackers to exploit…

  3 articles · Updated June 17, 2026

Recent Intelligence Reports

• Blog — oversecured.com · July 18, 2026
• VMware Avi Load Balancer: Critical vulnerability allows bypassing login — Heise.De · July 17, 2026
• Zero Day Initiative — www.zerodayinitiative.com · July 16, 2026
• openSUSE Tomcat11 Moderate Security Update for CVE-2026 — Linuxsecurity · July 15, 2026
• openSUSE Tomcat Moderate Security Concern - Advisory 2026-21327 — Linuxsecurity · July 15, 2026
• The July 2026 Security Update Review — Thezdi · July 14, 2026
• Proofpoint: UNK_MassTraction Report — www.proofpoint.com · July 14, 2026
• SAP warns of critical flaws in NetWeaver and Commerce Cloud — Bleepingcomputer · July 14, 2026

Related Entities