XSS - Vulnerability

Related Threat Clusters

• Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign

  Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial…

  53 articles · Updated July 23, 2026
• APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine

  Russian state-backed hackers from APT28 are actively exploiting a high-severity stored cross-site scripting vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS) to target Ukrainian government entities.…

  8 articles · Updated March 19, 2026
• Critical CVE-2026-48768 Vulnerability in TypeBot Exposes Users to File Upload Attacks

  A critical vulnerability, CVE-2026-48768, was disclosed affecting TypeBot versions 3.16.1 and earlier. The flaw allows unauthenticated users to exploit the POST /api/blocks/file-input/v3/generate-upload-url endpoint,…

  2 articles · Updated June 18, 2026
• Critical Stored XSS Vulnerability in SiYuan Enables Remote Code Execution

  SiYuan, an open-source personal knowledge management system, has disclosed a critical stored cross-site scripting (XSS) vulnerability that can escalate to remote code execution (RCE) in its Electron desktop client. The…

  7 articles · Updated June 25, 2026
• Russian APT Exploits Zimbra XSS to Target Ukrainian Government

  A Russian state-linked advanced persistent threat (APT) has targeted a Ukrainian government agency through a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite, identified as CVE-2025-66376. The…

  4 articles · Updated March 20, 2026
• CVE-2026-55879: Critical XSS Vulnerability in OpenReplay Leads to Account Takeover

  CVE-2026-55879 is a critical vulnerability affecting OpenReplay versions 1.24.0 to 1.25.0, allowing unauthenticated attackers to execute stored XSS in the dashboard. The flaw arises from the OpenReplay tracking SDK's…

  3 articles · Updated July 11, 2026
• Critical SSTI Vulnerability in FOSSBilling Exposes Databases to RCE Attacks

  A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, was disclosed on June 23, 2026. This flaw affects all versions up to 0.7.2 and allows attackers to exploit unsafe…

  2 articles · Updated June 26, 2026
• Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress

  The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload, allowing Remote Code Execution in all versions up to 5.1.8. This vulnerability arises from insufficient file extension validation in the…

  9 articles · Updated July 3, 2026
• Russian TA488 and TA458 Exploit Webmail Vulnerabilities in Espionage Campaigns

  Russian threat actors TA488 and TA458 are exploiting vulnerabilities in webmail servers, specifically targeting Ukrainian entities and government sectors. TA488 utilizes a half-click exploit via CVE-2025-66376 in Zimbra…

  2 articles · Updated July 23, 2026
• Chinese Threat Group Exploits Roundcube Vulnerabilities in University Networks

  A suspected China-aligned threat group, tracked as UNK_MassTraction, has been exploiting vulnerabilities in Roundcube mail servers at U.S. and Canadian universities since May 2026. The campaign targets physics and…

  14 articles · Updated July 7, 2026

Recent Intelligence Reports

• GitLab June 10 patch release — docs.gitlab.com · July 25, 2026
• CVE-2025-66376 — nvd.nist.gov · July 25, 2026
• WinterVivern — www.welivesecurity.com · July 24, 2026
• Operation Roundish — hunt.io · July 24, 2026
• Zimbra's November 2025 security release — wiki.zimbra.com · July 24, 2026
• ta458 roundpress exploits — Proofpoint · July 23, 2026
• TA488 Targets Zimbra Mailservers with Half — Proofpoint · July 23, 2026
• The July 2026 Security Update Review — www.zerodayinitiative.com · July 22, 2026

Related Entities