Do Son Jenkins patches a high-severity stored XSS flaw (CVE-2026-27099) and an info disclosure bug. Update to version 2.551 or LTS 2.541.2 to secure pipelines.
Cross-Site Scripting
Critical OpenCode flaws (CVE-2026-22813) allow drive-by RCE via malicious sites. Update to v1.0.216 immediately to stop unauthorized command execution.
Elastic patches a High-severity XSS flaw (CVE-2025-68385) in Kibana. Attackers can weaponize Vega visualizations to hijack sessions. Update now!
Roundcube patches two High-severity flaws: an SVG-based XSS and a CSS sanitizer bypass. Protect your inbox—update to v1.6.12 or v1.5.12 now.
A High-severity XSS flaw (CVE-2025-66412, CVSS 8.5) in Angular allows attackers to bypass sanitization and execute scripts via vulnerable SVG/MathML attributes. Update to v21.0.2 immediately.
GitLab patched multiple high-severity XSS and data exposure vulnerabilities in CE/EE, urging users to update to 18.2.1, 18.1.3, or 18.0.5.
Grafana Labs issued urgent patches for high-severity XSS (CVE-2025-6023) and medium-severity open redirect (CVE-2025-6197) vulnerabilities, impacting its observability platform.
Zoom rolls out security updates for 6 newly disclosed flaws in Workplace, Rooms, and SDK, addressing DoS, info disclosure, and XSS across all platforms. Update now!
Three flaws in Frappe Framework allow account takeover via password reset token leaks, XSS via file upload, and SQL injection. Update self-hosted ERPNext immediately!
Two severe Gogs flaws: CVE-2024-56731 (CVSS 10.0) allows RCE via symlink exploit, and CVE-2025-47943 (CVSS 6.3) is a stored XSS in PDF.js.
A high-severity XSS flaw (CVE-2025-5806) in Jenkins Gatling Plugin bypasses CSP, risking session hijacking and credential theft. Downgrade to v1.3.0 immediately!
A critical XSS vulnerability (CVSS 9.1) in Argo CD allows attackers to hijack user sessions and control Kubernetes resources. Update to fix
Learn about the Label Studio XSS flaw (CVE-2025-47783) that allows attackers to inject malicious scripts. Protect your data labeling projects.
Mitel warns of CVE-2025-23092, a reflected cross-site scripting vulnerability in MiContact Center Business. Learn more.
Stay secure with updates on CVE-2025-2255 & CVE-2025-0811. GitLab users must upgrade to versions 17.10.1, 17.9.3, or 17.8.6.
Stay informed about the record-breaking surge in CVE publications. Explore the key highlights from the annual CVE data review for 2024.
These flaws, identified as CVE-2024-33533, CVE-2024-33535, and CVE-2024-33536, impact Zimbra Collaboration versions 9.0 and 10.0
Netgear emphasizes the importance of downloading and installing the firmware updates to mitigate the risks associated with these vulnerabilities
WordPress has released a critical security update to address three vulnerabilities that could potentially expose millions of websites to cyber attacks
GrimResource technique capitalizes on an old XSS vulnerability in the apds.dll library, enabling attackers to execute arbitrary JavaScript code
Researchers have demonstrated that teams of AI agents, powered by large language models, can successfully exploit zero-day vulnerabilities
The most severe vulnerability, CVE-2024-4835 (CVSS 8.0), involves a cross-site scripting (XSS) flaw in the code editor on gitlab.com