Cross-site scripting vulnerabilities

XSS315 advisories34 exploitedlatest 2026-08-25

Cross-site scripting executes attacker-controlled JavaScript in another user’s browser session. Stored XSS in admin interfaces is the dangerous variant tracked here: it turns a low-privilege foothold into admin session theft, and several appliance XSS bugs have been chained into full compromise in real attacks.

Classification is assigned by the CSIRTS enrichment pipeline from the advisory text. The list below shows the latest advisories tagged cross-site scripting, newest first, across national CERTs, vendor PSIRTs and vulnerability databases — exploited marks CVEs in the CISA KEV catalog.

Latest cross-site scripting advisories

[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities

highCVE-2026-12975 CVE-2026-12992 CVE-2026-12993 CVE-2026-41240cert-bund2026-08-25

[NEW] [high] Contao: Multiple Vulnerabilities

highcert-bund2026-08-25

[NEW] [medium] Zammad: Multiple Vulnerabilities

mediumcert-bund2026-08-25

[NEW] [high] Mozilla Firefox, Firefox ESR and Thunderbird: Multiple Vulnerabilities

highCVE-2026-74934 CVE-2026-74935 CVE-2026-74936 CVE-2026-74937cert-bund2026-08-25

[NEW] [medium] Grafana: Vulnerability allows Cross-Site Scripting

mediumCVE-2026-17033cert-bund2026-08-25

[UPDATE] [high] IBM WebSphere Application Server: Multiple vulnerabilities

highCVE-2026-11708 CVE-2026-11712 CVE-2026-11595cert-bund2026-08-25

[UPDATE] [high] IBM WebSphere Application Server and Application Server Liberty: Multiple vulnerabilities

highCVE-2026-11383 CVE-2026-11536 CVE-2026-11541 CVE-2026-11594cert-bund2026-08-25

[UPDATE] [high] Apache HTTP Server: Multiple vulnerabilities

highCVE-2026-49975 CVE-2026-29167 CVE-2026-29170 CVE-2026-34355cert-bund2026-08-25

[NEW] [high] Snipe-IT: Multiple Vulnerabilities

highCVE-2026-62368 CVE-2026-63493 CVE-2026-63498cert-bund2026-08-25

[NEW] [high] Django: Multiple Vulnerabilities

highCVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920cert-bund2026-08-25

[NEW] [high] IBM WebSphere Application Server and Application Server Liberty: Multiple vulnerabilities

highCVE-2026-14446 CVE-2026-14512 CVE-2026-14515 CVE-2026-14528cert-bund2026-08-25

[NEW] [high] Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Multiple vulnerabilities

highCVE-2026-59873 CVE-2026-59874 CVE-2026-48801 CVE-2026-44289cert-bund2026-08-25

[NEW] [medium] ESRI Portal for ArcGIS: Multiple vulnerabilities

mediumCVE-2026-69224 CVE-2026-69225 CVE-2026-69228 CVE-2026-69229cert-bund2026-08-24

[NEW] [high] Golang Go: Multiple vulnerabilities

highCVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853cert-bund2026-08-24

[UPDATE] [medium] Golang Go-Module (Net, Image, Crypto): Multiple Vulnerabilities

mediumCVE-2026-25680 CVE-2026-25681 CVE-2026-27136 CVE-2026-39821cert-bund2026-08-24

[NEW] [high] Apache CloudStack: Multiple vulnerabilities

highCVE-2026-47359 CVE-2026-50112 CVE-2026-50222 CVE-2026-59085cert-bund2026-08-24

DSA-6463-1 webkit2gtk - security update

unknownCVE-2026-43804 CVE-2026-64713 CVE-2026-64719 CVE-2026-64728debian2026-08-24

CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards

unknownCVE-2026-77811aws2026-08-21

[NEW] [high] VMware Tanzu Spring Framework: Multiple vulnerabilities

highCVE-2026-47883 CVE-2026-47884 CVE-2026-47885 CVE-2026-47886cert-bund2026-08-21

[NEW] [high] VMware Tanzu Spring Security: Multiple vulnerabilities

highCVE-2026-41707 CVE-2026-47841 CVE-2026-47842 CVE-2026-47877cert-bund2026-08-21

[UPDATE] [high] BigBlueButton: Multiple Vulnerabilities

highCVE-2026-46355 CVE-2026-46682cert-bund2026-08-21

[UPDATE] [medium] Golang Go: Multiple vulnerabilities

mediumCVE-2026-27142 CVE-2026-33811 CVE-2026-33814 CVE-2026-39817cert-bund2026-08-21

NCSC-2026-0322 [1.00] [M/H] Vulnerabilities fixed in Splunk Enterprise by Splunk

unknownCVE-2026-76251 CVE-2026-76252 CVE-2026-76253 CVE-2026-76254ncsc-nl2026-08-21

[NEW] [high] n8n: Multiple Vulnerabilities

highcert-bund2026-08-21

[UPDATE] [medium] Znuny: Vulnerability enables Cross-Site Scripting

mediumCVE-2026-77506cert-bund2026-08-21

[UPDATE] [medium] BigBlueButton: Multiple Vulnerabilities

mediumCVE-2026-55491 CVE-2026-55489cert-bund2026-08-21

[NEW] [high] Microsoft Office Products: Multiple Vulnerabilities

highCVE-2026-68802 CVE-2026-68804 CVE-2026-68805 CVE-2026-68812cert-bund2026-08-21

Miraikan Assist App vulnerable to cross-site scripting

unknownCVE-2026-73537jvn2026-08-21

CVE-2026-5429 - Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme

unknownCVE-2026-5429aws2026-08-20

[UPDATE] [high] CyberPanel: Multiple vulnerabilities

highCVE-2026-41472 CVE-2026-41473cert-bund2026-08-20

[NEW] [high] Netgate pfSense: Multiple vulnerabilities

highCVE-2026-56126 CVE-2026-56127 CVE-2026-56128 CVE-2026-67189cert-bund2026-08-20

[NEW] [high] Splunk SOAR: Multiple vulnerabilities

highCVE-2025-13465 CVE-2025-13473 CVE-2025-14550 CVE-2025-15599cert-bund2026-08-20

[NEW] [medium] Cisco Industrial Ethernet 1000 Series Switches: Multiple vulnerabilities

mediumCVE-2026-20177 CVE-2026-20232cert-bund2026-08-20

NCSC-2026-0320 [1.00] [M/H] Vulnerabilities resolved in Zabbix

unknownCVE-2026-1199 CVE-2026-23922 CVE-2026-23929 CVE-2026-23930ncsc-nl2026-08-20

[UPDATE] [medium] Snipe-IT: Multiple vulnerabilities

mediumCVE-2026-55452 CVE-2026-55460 CVE-2026-55461 CVE-2026-55462cert-bund2026-08-20

[NEW] [high] Synacor Zimbra: Multiple vulnerabilities

criticalCVE-2026-10631 CVE-2026-50054 CVE-2026-50055cert-bund2026-08-20

Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability

mediumCVE-2026-20232cisco-psirt2026-08-19

[NEW] [high] Joomla: Multiple vulnerabilities

highCVE-2026-71572 CVE-2026-71573 CVE-2026-71574 CVE-2026-72531cert-bund2026-08-19

[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnerabilities

highexploitedCVE-2019-13990 CVE-2021-44906 CVE-2022-1471 CVE-2022-23521cert-bund2026-08-19

[NEW] [high] Zabbix: Multiple vulnerabilities

highCVE-2026-1199 CVE-2026-23922 CVE-2026-23929 CVE-2026-23930cert-bund2026-08-19

[UPDATE] [high] Froxlor: Multiple Vulnerabilities

highCVE-2026-62988 CVE-2026-54347 CVE-2026-54348 CVE-2026-54543cert-bund2026-08-19

[NEW] [high] IBM App Connect Enterprise: Vulnerability Enables Cross-Site Scripting

highCVE-2026-47423cert-bund2026-08-19

[NEW] [high] Rapid7 Velociraptor: Multiple vulnerabilities

highCVE-2026-15371 CVE-2026-17535 CVE-2026-18348 CVE-2026-18635cert-bund2026-08-19

[NEW] [high] n8n: Multiple vulnerabilities

highcert-bund2026-08-19

Multiple vulnerabilities in Joomla! (August 19, 2026)

unknownCVE-2026-73371 CVE-2026-73337 CVE-2026-73336 CVE-2026-71574cert-fr-avis2026-08-19

[NEW] [high] Roundcube Webmail: Multiple vulnerabilities

highCVE-2026-74997 CVE-2026-74998 CVE-2026-74999 CVE-2026-75000cert-bund2026-08-18

[UPDATE] [medium] Apache Tomcat: Multiple vulnerabilities

mediumCVE-2026-50229 CVE-2026-53404 CVE-2026-53434 CVE-2026-55276cert-bund2026-08-18

[NEW] [high] Gitea: Multiple vulnerabilities

highCVE-2026-60008 CVE-2026-73278 CVE-2026-73535 CVE-2026-73539cert-bund2026-08-17

[NEW] [high] WP Royal Royal Elementor Addons: Multiple vulnerabilities

highCVE-2026-19217 CVE-2026-17123cert-bund2026-08-17

[UPDATE] [high] pgAdmin: Multiple vulnerabilities

highCVE-2026-12045 CVE-2026-12046 CVE-2026-12047 CVE-2026-12048cert-bund2026-08-17

Other vulnerability classes

Remote code execution (2023)Privilege escalation (1548)Authentication bypass (1066)Denial of service (2105)Information disclosure (1543)Memory corruption (1308)Path traversal (235)Code injection (343)Unsafe deserialization (83)SQL injection (143)Server-side request forgery (109)

New cross-site scripting advisories, in your inbox. The daily briefing covers every advisory in this class the morning after it lands. Subscribe free — one email every morning after 06:00 UTC, one-click unsubscribe. Tracking specific products instead? Watch them from any product page and get alerted only when they ship a new advisory.