kagi vuln 2/4:
stored xss in kagi assistant ($150)
so this one is just a simple html file upload, though it only affected the specific shared attachment endpoint and didn't work for the usual /uploads/ path
stored xss in kagi assistant ($150)
so this one is just a simple html file upload, though it only affected the specific shared attachment endpoint and didn't work for the usual /uploads/ path
November 8, 2026 at 2:04 PM
kagi vuln 2/4:
stored xss in kagi assistant ($150)
so this one is just a simple html file upload, though it only affected the specific shared attachment endpoint and didn't work for the usual /uploads/ path
stored xss in kagi assistant ($150)
so this one is just a simple html file upload, though it only affected the specific shared attachment endpoint and didn't work for the usual /uploads/ path
November 8, 2026 at 1:11 PM
CVE-2026-60043 - XSS in backend
CVE ID : CVE-2026-60043
Published : Nov. 10, 2026, 8:37 a.m. | 38 minutes ago
Description : An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions....
CVE ID : CVE-2026-60043
Published : Nov. 10, 2026, 8:37 a.m. | 38 minutes ago
Description : An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions....
CVE-2026-60043 - XSS in backend
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
cvefeed.io
November 10, 2026 at 9:38 AM
CVE-2026-60043 - XSS in backend
CVE ID : CVE-2026-60043
Published : Nov. 10, 2026, 8:37 a.m. | 38 minutes ago
Description : An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions....
CVE ID : CVE-2026-60043
Published : Nov. 10, 2026, 8:37 a.m. | 38 minutes ago
Description : An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions....
If the session lives in localStorage, any XSS can grab it.
HttpOnly + Secure cookies keep the token out of JavaScript.
Short tip: abbilabs.xyz/tips/httponl...
#AppSec #vibecoding #webdev #javascript #SaaS #buildinpublic #security #Cursor
HttpOnly + Secure cookies keep the token out of JavaScript.
Short tip: abbilabs.xyz/tips/httponl...
#AppSec #vibecoding #webdev #javascript #SaaS #buildinpublic #security #Cursor
November 9, 2026 at 6:45 AM
If the session lives in localStorage, any XSS can grab it.
HttpOnly + Secure cookies keep the token out of JavaScript.
Short tip: abbilabs.xyz/tips/httponl...
#AppSec #vibecoding #webdev #javascript #SaaS #buildinpublic #security #Cursor
HttpOnly + Secure cookies keep the token out of JavaScript.
Short tip: abbilabs.xyz/tips/httponl...
#AppSec #vibecoding #webdev #javascript #SaaS #buildinpublic #security #Cursor
November 7, 2026 at 4:59 PM
14 layers of XSS checks for your React app. Run them!
Open source xss-audit earned bug bounties. Static only. You verify findings.
Source: https://github.com/songjianyang/xss-audit
Save this. Which repo will you audit first?
#WebSecurity #OpenSource
Open source xss-audit earned bug bounties. Static only. You verify findings.
Source: https://github.com/songjianyang/xss-audit
Save this. Which repo will you audit first?
#WebSecurity #OpenSource
November 6, 2026 at 8:02 PM
14 layers of XSS checks for your React app. Run them!
Open source xss-audit earned bug bounties. Static only. You verify findings.
Source: https://github.com/songjianyang/xss-audit
Save this. Which repo will you audit first?
#WebSecurity #OpenSource
Open source xss-audit earned bug bounties. Static only. You verify findings.
Source: https://github.com/songjianyang/xss-audit
Save this. Which repo will you audit first?
#WebSecurity #OpenSource
Auch um XSS und TLS1.3?
Frage für einen Freund.
Frage für einen Freund.
November 10, 2026 at 8:48 AM
Auch um XSS und TLS1.3?
Frage für einen Freund.
Frage für einen Freund.
Securing Collaborative Platforms: Mitigating SSRF and Stored XSS Vulnerabilities in Foxit Workspace + Video
Introduction: Foxit Workspace's November 6, 2026 security bulletin addresses critical vulnerabilities, specifically two Server-Side Request Forgery (SSRF) flaws (CVE-2026-119431 and…
Introduction: Foxit Workspace's November 6, 2026 security bulletin addresses critical vulnerabilities, specifically two Server-Side Request Forgery (SSRF) flaws (CVE-2026-119431 and…
Securing Collaborative Platforms: Mitigating SSRF and Stored XSS Vulnerabilities in Foxit Workspace + Video
Introduction: Foxit Workspace's November 6, 2026 security bulletin addresses critical vulnerabilities, specifically two Server-Side Request Forgery (SSRF) flaws (CVE-2026-119431 and CVE-2026-119433) and a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-119432). These flaws highlight the inherent security risks associated with modern document collaboration platforms, where user-supplied content and backend server requests intersect. Understanding and mitigating these attack vectors is essential for cloud infrastructure administrators and application security professionals.
undercodetesting.com
November 9, 2026 at 5:55 PM
Securing Collaborative Platforms: Mitigating SSRF and Stored XSS Vulnerabilities in Foxit Workspace + Video
Introduction: Foxit Workspace's November 6, 2026 security bulletin addresses critical vulnerabilities, specifically two Server-Side Request Forgery (SSRF) flaws (CVE-2026-119431 and…
Introduction: Foxit Workspace's November 6, 2026 security bulletin addresses critical vulnerabilities, specifically two Server-Side Request Forgery (SSRF) flaws (CVE-2026-119431 and…
CRITICAL XSS vuln (CVE-2026-60043, CVSS 9.3) lets remote attackers run scripts as backend users — can shut down servers or restore backups. Restrict backend access & watch for patches. https://radar.offseq.com/threat/an-unauthenticated-remote-attacker-can-perform-a-xss-attack-on-a-logged-in-backe...
An unauthenticated remote attacker can perform a XSS attack on a logged in backe
This vulnerability permits an unauthenticated remote attacker to perform a cross-site scripting (XSS) attack targeting logged-in backend users. Successful exploitation enables the attacker to execute multiple critical system actions, includ
radar.offseq.com
November 10, 2026 at 10:30 AM
CRITICAL XSS vuln (CVE-2026-60043, CVSS 9.3) lets remote attackers run scripts as backend users — can shut down servers or restore backups. Restrict backend access & watch for patches. https://radar.offseq.com/threat/an-unauthenticated-remote-attacker-can-perform-a-xss-attack-on-a-logged-in-backe...
🔴 CVE-2026-60043 - Critical (9.3)
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing ...
https://www.thehackerwire.com/vulnerability/CVE-2026-60043/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing ...
https://www.thehackerwire.com/vulnerability/CVE-2026-60043/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
November 10, 2026 at 9:48 AM
🔴 CVE-2026-60043 - Critical (9.3)
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing ...
https://www.thehackerwire.com/vulnerability/CVE-2026-60043/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing ...
https://www.thehackerwire.com/vulnerability/CVE-2026-60043/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
Shipping React code and unsure whether a stray dangerouslySetInnerHTML or unsafe URL slipped through review? xss-audit from is an agent skill that runs a 14-layer static XSS audit on React, TypeScript and JavaScript codebases. It checks DOM sinks, JSON-in-script breakouts, prototype pollution,...
November 5, 2026 at 4:57 AM
Shipping React code and unsure whether a stray dangerouslySetInnerHTML or unsafe URL slipped through review? xss-audit from is an agent skill that runs a 14-layer static XSS audit on React, TypeScript and JavaScript codebases. It checks DOM sinks, JSON-in-script breakouts, prototype pollution,...
As a tech writer I’d expect him to be able to compare across the base ps5, xss, xsx and ps5 pro
November 10, 2026 at 8:08 PM
As a tech writer I’d expect him to be able to compare across the base ps5, xss, xsx and ps5 pro
🚨 EUVD-2025-211283
📊 7.2/10
🏢 Opentext
📝 XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211283
#cybersecurity #infosec #cve #euvd
📊 7.2/10
🏢 Opentext
📝 XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211283
#cybersecurity #infosec #cve #euvd
November 9, 2026 at 4:01 PM
🚨 EUVD-2025-211283
📊 7.2/10
🏢 Opentext
📝 XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211283
#cybersecurity #infosec #cve #euvd
📊 7.2/10
🏢 Opentext
📝 XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-211283
#cybersecurity #infosec #cve #euvd
#🔖テクノロジー
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
Over 350 High-Profile Websites Hit by 360XSS Attack 2025/02/28 HackRead — 360XSS と呼ばれるキャンペーンは、Krpano の XSS の脆弱性を悪用することで検索結果を乗っ取り、政府／大学／報道などの 350 以上の Web サイトでスパム広告を配信するものだ。 仮想ツアー・フレームワーク Krpano 内の XSS 脆弱性を悪用す...
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
Over 350 High-Profile Websites Hit by 360XSS Attack 2025/02/28 HackRead — 360XSS と呼ばれるキャンペーンは、Krpano の XSS の脆弱性を悪用することで検索結果を乗っ取り、政府／大学／報道などの 350 以上の Web サイトでスパム広告を配信するものだ。 仮想ツアー・フレームワーク Krpano 内の XSS 脆弱性を悪用す...
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
iototsecnews.jp
November 9, 2026 at 9:05 PM
#🔖テクノロジー
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
Over 350 High-Profile Websites Hit by 360XSS Attack 2025/02/28 HackRead — 360XSS と呼ばれるキャンペーンは、Krpano の XSS の脆弱性を悪用することで検索結果を乗っ取り、政府／大学／報道などの 350 以上の Web サイトでスパム広告を配信するものだ。 仮想ツアー・フレームワーク Krpano 内の XSS 脆弱性を悪用す...
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
Over 350 High-Profile Websites Hit by 360XSS Attack 2025/02/28 HackRead — 360XSS と呼ばれるキャンペーンは、Krpano の XSS の脆弱性を悪用することで検索結果を乗っ取り、政府／大学／報道などの 350 以上の Web サイトでスパム広告を配信するものだ。 仮想ツアー・フレームワーク Krpano 内の XSS 脆弱性を悪用す...
⚠️ Hosting UK is reporting an Incident since 20:27 UTC
"NUMA-XSS"
Live timeline → https://pingoru.io/providers/hosting-uk/incidents/12479505?utm_source=bluesky&utm_content=inc-12479505
#HostingUK #HostingUKDown
"NUMA-XSS"
Live timeline → https://pingoru.io/providers/hosting-uk/incidents/12479505?utm_source=bluesky&utm_content=inc-12479505
#HostingUK #HostingUKDown
Hosting UK: NUMA-XSS · November 10, 2026 · Pingoru
Hosting UK incident on November 10, 2026: alert(document.domain) Started 8:27 PM UTC, resolved ongoing (● 7m).
pingoru.io
November 10, 2026 at 8:35 PM
⚠️ Hosting UK is reporting an Incident since 20:27 UTC
"NUMA-XSS"
Live timeline → https://pingoru.io/providers/hosting-uk/incidents/12479505?utm_source=bluesky&utm_content=inc-12479505
#HostingUK #HostingUKDown
"NUMA-XSS"
Live timeline → https://pingoru.io/providers/hosting-uk/incidents/12479505?utm_source=bluesky&utm_content=inc-12479505
#HostingUK #HostingUKDown
CVE-2026-5410: Stored XSS in Redux Framework WordPress plugin (spinner field, user_meta_save bypass) up to 4.5.13. CVSS 6.4. Patch still under review - restrict plugin access and sanitize user meta now. #CVE #infosec #WordPress https://www.valtersit.com/cve/CVE-2026-5410/
November 8, 2026 at 8:10 AM
CVE-2026-5410: Stored XSS in Redux Framework WordPress plugin (spinner field, user_meta_save bypass) up to 4.5.13. CVSS 6.4. Patch still under review - restrict plugin access and sanitize user meta now. #CVE #infosec #WordPress https://www.valtersit.com/cve/CVE-2026-5410/
📢 New #updates · 9 Nov #14.3
· lightdash 3.189.0 — Added app state admin panel to manage view
· kroki v0.36.0 — Security fixes for XSS and RCE vulnerabilities
· lightdash 3.189.0 — Added app state admin panel to manage view
· kroki v0.36.0 — Security fixes for XSS and RCE vulnerabilities
November 9, 2026 at 7:25 PM
📢 New #updates · 9 Nov #14.3
· lightdash 3.189.0 — Added app state admin panel to manage view
· kroki v0.36.0 — Security fixes for XSS and RCE vulnerabilities
· lightdash 3.189.0 — Added app state admin panel to manage view
· kroki v0.36.0 — Security fixes for XSS and RCE vulnerabilities
Does the stored XSS trigger on admin dashboard load or only after specific user interaction?
November 7, 2026 at 9:25 AM
Does the stored XSS trigger on admin dashboard load or only after specific user interaction?
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
https://iototsecnews.jp/2025/02/28/over-350-high-profile-websites-hit-by-360xss-attack/
https://iototsecnews.jp/2025/02/28/over-350-high-profile-websites-hit-by-360xss-attack/
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
Over 350 High-Profile Websites Hit by 360XSS Attack 2025/02/28 HackRead — 360XSS と呼ばれるキャンペーンは、Krpano の XSS の脆弱性を悪用することで検索結果を乗っ取り、政府／大学／報道などの 350 以上の Web サイトでスパム広告を配信するものだ。…
iototsecnews.jp
November 9, 2026 at 9:05 PM
Krpano 360° の脆弱性 CVE-2020-24901 を悪用：検索結果を操作する大規模な XSS キャンペーン
https://iototsecnews.jp/2025/02/28/over-350-high-profile-websites-hit-by-360xss-attack/
https://iototsecnews.jp/2025/02/28/over-350-high-profile-websites-hit-by-360xss-attack/
Vinny gives me the ick. Idk how anyone could ever date or fw him. Who wants to sign up to be a grown xss man's mommy? If a woman wants a child, she'll have one. She won't often go looking for a grown man baby to take care of instead. 🤮 #JSFV #JerseyShore #FamilyVacation #JerseyShoreFamilyVacation
November 9, 2026 at 12:26 AM
Vinny gives me the ick. Idk how anyone could ever date or fw him. Who wants to sign up to be a grown xss man's mommy? If a woman wants a child, she'll have one. She won't often go looking for a grown man baby to take care of instead. 🤮 #JSFV #JerseyShore #FamilyVacation #JerseyShoreFamilyVacation