XSS
Security incidents tagged XSS. Newest first.
6 XSS incidents in the last 12 months
- Incidents
- 10
- Live
- 6
- Patched
- 10
- Days without an incident
- 2
- Longest quiet run: 999 days (Oct 27–Jul 21)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- LivePatched
Foxit Workspace: SSRF in file upload and PDF export plus stored XSS in file share preview (CVE-2026-119431, CVE-2026-119433, CVE-2026-119432)
On Nov 6 2026 Foxit updated its hosted Foxit Workspace service (https://ai.foxit.com/) for three Important issues. CVE-2026-119431 and CVE-2026-119433 are server-side request forgery flaws in the file-upload and PDF-export flows: insufficient validation of user-supplied URLs and network parameters could let an authenticated attacker make the service fetch arbitrary internal or external resources and return their contents (CVSS 3.0 7.7). CVE-2026-119432 is a stored cross-site scripting bug in file share preview: an attacker could upload a crafted file, share it, and when a victim opens or previews it the script runs in the application origin and may access locally stored credentials (CVSS 3.0 8.7). Foxit rates all three Important and says no customer action is required; the hosted service is already patched. Reported by mrfathoni.
Foxit Workspace (https://ai.foxit.com/)Since Nov 6, 2026
- LivePatched
INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50
INFINITT Healthcare advisory INFINITT-SA-2026-001 (Nov 5 2026) and NCSC.ch CVE records cover two issues in the ULite medical imaging universal viewer. CVE-2026-19877 (High, CVSS 3.1 7.5) lets an unauthenticated remote attacker brute-force the low-entropy password on image-share links with no attempt limiting, gaining unauthorized access to shared medical images within the link validity window on ULite 5.0.2.1_BN48_20260528 and earlier. CVE-2026-19876 (Medium, CVSS 6.1) is a pre-authentication reflected XSS on the login/SSO error page via an unsanitized request parameter. Both are fixed in ULite 5.0.2.1 BN50. INFINITT says there is no indication of exploitation and is deploying the update to customers under existing maintenance agreements; sites should schedule the BN50 update with INFINITT support.
INFINITT ULite (universal medical image viewer)Since Nov 5, 2026
- LivePatched
Gitea 28.3.0 security release: OAuth2 account-linking takeover and Actions/token fixes
Gitea 28.3.0 (third maintenance release of the 28 series) ships a large security batch. CVE-2026-120263: when ACCOUNT_LINKING=auto and registration is enabled, the link-account sign-up form looked up the account to link by attacker-submitted username/email instead of the OAuth2 identity, allowing passwordless takeover of existing accounts. The release also fixes high-severity Actions issues (fork workflows obtaining secrets/write tokens via review commit_id; Actions task tokens authenticating to the REST API without scope), stored XSS via artifact Content-Encoding, write-collaborator release/milestone/label destruction on archived repos, and additional medium issues around token scopes. Gitea strongly recommends upgrading ASAP. Fixed in 28.3.0.
GiteaSince Nov 1, 2026
- LivePatched
Jenkins core: 15 vulnerabilities including XStream deserialization RCE and a setup-wizard admin takeover race (Jenkins 2.588, LTS 2.580.2)
The Jenkins project published a core security advisory on Oct 28 fixing 15 vulnerabilities in Jenkins weekly 2.587 and earlier and LTS 2.580.1 and earlier, 13 rated High and 2 Medium. The most serious: CVE-2026-117612 lets attackers with Overall/Read and a user account (or any config.xml POST permission) instantiate arbitrary types through XStream's resolves-to attribute, potentially leading to remote code execution. CVE-2026-117614 lets users with Agent/Configure run arbitrary code on the controller through unapproved legacy agent launch commands. CVE-2026-117615, CVE-2026-117616 and CVE-2026-117617 allow arbitrary file read, config.xml overwrite and arbitrary file writes on the controller that can lead to code execution. CVE-2026-117618 is a race in the setup wizard that lets unauthenticated attackers create an administrator account while the initial account is being replaced, and CVE-2026-117620 lets Overall/Read users take over accounts through the Manage Old Data feature. The rest are stored XSS, a remember-me cookie that survives API token revocation, and information leaks. All are fixed in Jenkins 2.588 and LTS 2.580.2. Many were reported by the Anthropic OSS program.
Jenkins (core), weekly and LTSSince Oct 28, 2026
- LivePatched
WordPress 7.1.4 security release: upgrade-window RCE under exploitation attempts, plus stored XSS fixes
WordPress released 7.1.4 on Oct 28 2026 as a security release and recommends updating sites immediately. It fixes a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window (reported by Umut Bayram), a long list of stored XSS issues (crafted block markup, Privacy Data Removal Requests, the Interactivity API, Customizer selective refresh, the Categories, Playlist, image and comments-pagination blocks, and specially crafted user logins), a stored denial of service in the Interactivity API, unpublished Customizer changesets being discoverable by unauthenticated users, and Notes being readable by privileged users who can't edit the post. It also updates the bundled root certificates because of the eMudhra revocation. Sites with automatic background updates get it automatically; the fixes are being backported to every branch still eligible for security fixes (back to 4.7), and those backports ship as they become ready. WordPress 7.2 Beta 3 has the same fixes. Wordfence rates the upgrade-window RCE CVSS 8.1 (unauthenticated, high complexity: WordPress 4.7 to 7.1.3 unpack full-package updates into a predictable, web-reachable folder under wp-content/upgrade, and an attacker who requests the staged installer in the seconds-long window can reach PHP code execution). Wordfence says attackers began trying to exploit it within minutes of its firewall rule going live on Oct 28 and logged more than 18,500 requests to staged setup-config.php paths in 21 hours; it reports attempts, not confirmed compromises.
WordPress coreSince Oct 28, 2026
Show 5 older incidents5 older incidents
July 2026 1
- LivePatched
JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1
NVD published four JupyterLab Desktop CVEs on 2026-11-06 for issues patched in the Jul 22 2026 v4.6.2-1 security release (first Desktop release in two years). Two are critical remote code execution: CVE-2026-102530 (CVSS 9.4) — unsanitized remote-server URLs in the Connect dialog / Welcome view enable XSS that abuses the privileged Electron IPC bridge; and CVE-2026-86044 (CVSS 9.6) — a MathJax link in an untrusted notebook plus a getServerInfo IPC leak lets one click hand the local Jupyter server token to an attacker site for RCE (requires JupyterLab < 4.4.8 in the managed environment). Two medium macOS-only TCC bypasses (CVE-2025-54991 / CVE-2025-55002, CVSS 5.5) need existing local code execution. Affected: Desktop <= v4.2.5-1. Upgrade to 4.6.2-1.
JupyterLab Desktop (jupyterlab/jupyterlab-desktop)Since Jul 22, 2026
October 2023 1
PatchedRoundcube Webmail: Persistent Cross-Site Scripting (XSS) (CVE-2023-5631)
Roundcube Webmail
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. Added to CISA KEV on 2023-10-26.
Open incident →CVE-2023-5631
July 2023 1
PatchedSynacor Zimbra Collaboration Suite (ZCS): Cross-Site Scripting (XSS) (CVE-2023-37580)
Synacor Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data. Added to CISA KEV on 2023-07-27.
Open incident →CVE-2023-37580
April 2023 1
PatchedSynacor Zimbra Collaboration Suite (ZCS): Cross-Site Scripting (XSS) (CVE-2022-27926)
Synacor Zimbra Collaboration Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. Added to CISA KEV on 2023-04-03.
Open incident →CVE-2022-27926
March 2023 1
PatchedFortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)
Fortra Cobalt Strike
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Added to CISA KEV on 2023-03-30.
Open incident →CVE-2022-39197 · CVE-2022-42948