XSS - Vulnerability

Related Threat Clusters

• Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign

  Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial…

  82 articles · Updated July 23, 2026
• APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine

  Russian state-backed hackers from APT28 are actively exploiting a high-severity stored cross-site scripting vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities.…

  8 articles · Updated March 19, 2026
• Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway

  Sangoma Switchvox SMB Edition 8.3 is facing active exploitation of multiple vulnerabilities, particularly CVE-2026-9586, which allows unauthenticated SQL injection leading to remote code execution. The flaw can be…

  11 articles · Updated September 2, 2026
• Critical CVE-2026-48768 Vulnerability in TypeBot Exposes Users to File Upload Attacks

  A critical vulnerability, CVE-2026-48768, was disclosed affecting TypeBot versions 3.16.1 and earlier. The flaw allows unauthenticated users to exploit the POST /api/blocks/file-input/v3/generate-upload-url endpoint,…

  2 articles · Updated June 18, 2026
• Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution

  SiYuan, an open-source personal knowledge management system, has disclosed a critical stored cross-site scripting (XSS) vulnerability that can escalate to remote code execution (RCE) in its Electron desktop client. The…

  7 articles · Updated June 25, 2026
• Critical Stored XSS Vulnerabilities Found in SiYuan Versions Before 3.7.4

  Two critical vulnerabilities, CVE-2026-73050 and CVE-2026-73052, have been identified in SiYuan versions prior to 3.7.4. CVE-2026-73050 allows attackers to exploit stored cross-site scripting (XSS) via unescaped color…

  13 articles · Updated August 16, 2026
• Russian APT Exploits Zimbra XSS to Target Ukrainian Government

  A Russian state-linked advanced persistent threat (APT) has targeted a Ukrainian government agency through a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite, identified as CVE-2025-66376. The…

  4 articles · Updated March 20, 2026
• CVE-2026-55879: Critical XSS Vulnerability in OpenReplay Leads to Account Takeover

  CVE-2026-55879 is a critical vulnerability affecting OpenReplay versions 1.24.0 to 1.25.0, allowing unauthenticated attackers to execute stored XSS in the dashboard. The flaw arises from the OpenReplay tracking SDK's…

  3 articles · Updated July 11, 2026
• Critical SSTI Vulnerability in FOSSBilling Exposes Databases to RCE Attacks

  A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, was disclosed on June 23, 2026. This flaw affects all versions up to 0.7.2 and allows attackers to exploit unsafe…

  2 articles · Updated June 26, 2026
• Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress

  The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload, allowing Remote Code Execution in all versions up to 5.1.8. This vulnerability arises from insufficient file extension validation in the…

  9 articles · Updated July 3, 2026

Recent Intelligence Reports

• SecurityAffairs — securityaffairs.co · September 9, 2026
• MapLibre Vulnerability Exposes 2.7M Users to Zero — Cybersecuritynews · September 9, 2026
• Critical MapLibre GL JS Vulnerability Enables Zero — Gbhackers · September 9, 2026
• Rocky Linux 8 xmlrpc-c Important Cross-Site Scripting Vuln RLSA-2026 — Linuxsecurity · September 9, 2026
• CWE-116: Improper Encoding or Escaping of Output — cwe.mitre.org · September 8, 2026
• CWE-184: Incomplete List of Disallowed Inputs — cwe.mitre.org · September 8, 2026
• CVE-2026 — Api.Msrc.Microsoft · September 8, 2026
• CVE-2026 — Api.Msrc.Microsoft · September 8, 2026

Related Entities