SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits. - chaitin/SafeLine

XSS in The Digital #ClimateStrike Widget

A hard Cross-Site Scripting challenge chaining small bugs with one very hard step to leak a fragment directive using Self XSS

We found a stored XSS in Roundcube's draft attachment endpoint that, chained with a cookie tossing technique, gives an attacker full access to a victim's inbox. Here's how the exploit chain works and ...

From Subdomain Chaos to an Unexpected XSS A beginner’s bug bounty journey that led to a hidden Self-XSS on Paytm, with the help of some…

n8n published a batch of security advisories on Sep 30, 2026; fixes are available in 1.123.83, 2.42.1, and 2.41.4. Self‑hosted and automation teams should upgrade immediately and review logs, credentials, and webhooks for abuse indicators.

YouTube video by Bugcrowd

Here's yet another example of a lethal trifecta attack, where an LLM system combines access to private data, exposure to potentially malicious instructions and a mechanism to communicate data back …

GitLab has released urgent security updates for its Community Edition (CE) and Enterprise Edition (EE) to address a wide range of vulnerabilities. The newly released versions 18.9.2, 18.8.6, and 18.7.6 fix a total of 15 security issues, including critica l Cross-Site Scripting (XSS) and Denial-of-Service (DoS) flaws. Administrators of self-managed instances are strongly urged to apply these patches immediately to maintain good security hygiene and protect their environments.​ GitLab Vulnerabilities Patched The most critical issue addressed in this release is CVE-2026-1090, a high-severity XSS vulnerability with a CVSS score of 8.7. This flaw exists in GitLab’s Markdown placeholder processing when the Markdown placeholders feature flag is enabled. An authenticated attacker can bypass proper sanitization checks to inject malicious JavaScript into a victim’s browser, potentially leading to unauthorized actions or session hijacking. Additionally, GitLab patched three high-severity DoS vulnerabilities that could allow unauthenticated attackers to disrupt critical services. A flaw in the GraphQL API allows specially crafted requests to cause uncontrolled recursion and resource exhaustion. Malicious requests sent to the repository archive endpoints can also trigger a denial-of-service attack under specific conditions. Furthermore, improper validation of JSON payloads in the protected branches API can be easily exploited to crash the service. Beyond the high-severity issues, this update resolves several medium and low-severity bugs. Notable fixes include addressing DoS risks in webhook custom headers (CVE-2025-13690) and webhook endpoints (CVE-2025-12576). The patch also neutralizes  improper CRLF sequences (CVE-2026-3848) and fixes access control issues in the runners API (CVE-2025-12555), which could have allowed unauthorized access to previous pipeline job information. Information disclosure bugs affecting confidential issues were also successfully remediated. The security update addresses several specific CVEs that administrators should track. CVE-2026-1090 is a high-severity cross-site scripting flaw in Markdown placeholder processing with a CVSS score of 8.7. There are also three high-severity denial-of-service vulnerabilities, each with a CVSS score of 7.5: CVE-2026-1069 affects the GraphQL API, CVE-2025-13929 impacts the repository archive endpoint, and CVE-2025-14513 targets the protected branches API. Furthermore, the patch resolves two medium-severity denial-of-service issues, both scoring 6.5 on the CVSS scale, involving webhook custom headers (CVE-2025-13690) and the webhook endpoint (CVE-2025-12576). To ensure continuous service and data protection, organizations must take immediate action. Update all self-managed GitLab CE and EE installations to versions 18.9.2, 18.8.6, or 18.7.6. Single-node instances will experience brief downtime during the upgrade as database migrations complete. In contrast, multi-node setups can utilize zero-downtime upgrade procedures. Users on GitLab.com and GitLab Dedicated are already running the patched versions and require no administrative action. Detailed vulnerability reports will be made public on GitLab’s issue tracker 30 days after this patch release. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post GitLab Security Update – Patch for XSS and API DoS Vulnerabilities appeared first on Cyber Security News .

n8n published ten GitHub security advisories on Sep 30, 2026, including High‑severity items such as Git node code execution, an HMAC approval bypass, SQL injection, stored XSS, and an owner‑takeover via prototype mutation; patched builds 1.123.83, 2.41.4, and 2.42.1 are available. Self‑hosters shoul

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the …

YouTube video by BePractical

A Self-XSS in the profile bio editor is harmless on its own. Chain it with a missing CSRF token on the update endpoint and you get cross-user profile takeover.

A Self-XSS in the profile bio editor is harmless on its own. Chain it with a missing CSRF token on the update endpoint and you get cross-user profile takeover.

A Self-XSS in the profile bio editor is harmless on its own. Chain it with a missing CSRF token on the update endpoint and you get cross-user profile takeover.

YouTube video by WebWonders