JetBrains YouTrack contains a cross-site scripting (XSS) vulnerability. The vulnerability allows injection of malicious scripts into the application, potentially impacting users who interact with the affected components. No specific affected versions or exploitation details are provided.
Qilin is a Russia-based ransomware affiliate group active since September 2022, responsible for at least 365 victim organizations in three months. It operates a ransomware-as-a-service model with affiliates who deploy ransomware and practice double extortion by stealing data before encrypting systems. The group's administrator, known as 'Haise,' has been linked through operational security mistakes to a 36-year-old man in St. Petersburg, Russia, named Aleksey Mikhailovich Yakovtsev. Qilin collaborates with English-speaking affiliates and other ransomware groups. The administrator's past identities and activities have been traced through cybercrime forums and leaked data, revealing a progression from fraud to complex cybercrime operations.
Able2Shell is a collection of 33 reported zero-day vulnerabilities in N-able N-central, disclosed publicly with proof-of-concept code. Among these, seven critical vulnerabilities have been officially recognized and patched by N-able in the N-central 2026.4 Hotfix 2 release. The vulnerabilities include high-severity issues such as XML external entity (XXE) attacks, server-side request forgery (SSRF), OGNL injection, local privilege escalation, remote code execution, and stored cross-site scripting (XSS). One exploit chain allows unauthenticated remote command execution as the nable user, and others can lead to root privileges through chained exploits. N-able has confirmed and patched the most critical issues but has not mapped all 33 findings individually. The affected versions are N-central prior to 2026.4.1.26. No confirmed customer compromises have been reported as of November 10, 2026.
CVE-2026-121652 is a stored cross-site scripting (XSS) vulnerability in the AWS Amplify library maplibre-gl-js-amplify, which integrates Amazon Location Service with MapLibre GL JS. The flaw affects popup and geofence-control rendering, allowing malicious scripts to be stored and executed in web applications using versions up to 4.0.2.
This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.
CVE-2026-120497 is a stored cross-site scripting (XSS) vulnerability in the HTML report generator of the aidlc-traceability command-line tool used in AWS AI-DLC Workflows. An attacker who can modify AI-DLC artifact files can inject malicious scripts into report titles or descriptions, which execute when a user opens the generated HTML traceability report. This affects versions from 0.1.0 up to the commit fixed on 2026-07-03.
CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.
Cisco released patches addressing 34 vulnerabilities across multiple products including Expressway Series, IOS XR, Snort 3, and Unified Communications. The vulnerabilities include critical remote code execution, authentication bypass, and cross-site scripting issues. Notably, a critical remote code execution flaw in Expressway Series could allow attackers to execute arbitrary commands as root. Other critical issues affect Unified Communications and Snort 3 products. Cisco is not aware of any active exploitation of these vulnerabilities in the wild.
The LIFF SDK provided by LY Corporation contains a cross-site scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. No specific affected versions or patch information are provided.
Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that allows attackers with upload access to execute arbitrary JavaScript in an administrator's browser. This can lead to theft of administrator authentication tokens and unauthorized access to the Shopware Administration API. If the compromised administrator has extension management privileges, attackers can upload and activate malicious plugins to achieve remote code execution on the server. No vendor patch or statement is currently available. Mitigation involves restricting media upload access to trusted users or disabling HTML file uploads.
Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities affecting file management, Smarty templating, module installation, and administrative workflows. These include remote code execution, server-side template injection, stored and reflected cross-site scripting, open redirect, and username enumeration. Exploitation requires authenticated administrative access for most issues, but some vulnerabilities enable unauthenticated attackers to enumerate valid admin usernames. No patch is currently available, and risk mitigation involves restricting administrative interface access and disabling or limiting certain features.
Stored cross-site scripting (XSS) vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins are being exploited to install backdoors and create rogue administrator accounts. The attacks deliver malicious JavaScript payloads that execute in the context of authenticated administrators, allowing the installation of a malicious plugin and creation of hidden admin accounts. These backdoors persist even after removal of the malicious plugin. The vulnerabilities require an authenticated session to exploit and affect Ninja Forms versions 3.15.3 and older and WPC Product Bundles for WooCommerce versions 8.6.6 and older. Site administrators are advised to upgrade to Ninja Forms 3.15.4 or later and WPC Product Bundles for WooCommerce 8.6.7 or later. Existing infections require manual cleanup as updates do not remove backdoors.
Readwise Reader for Android version 8.7.2 contains three stored cross-site scripting (XSS) vulnerabilities. These flaws allow attackers who can supply malicious documents or metadata to execute arbitrary JavaScript within the app's WebView context. The vulnerabilities arise from insufficient sanitization of document metadata fields, improper escaping of URL metadata, and permissive sanitization rules for SVG markup. Exploitation could compromise user data confidentiality and integrity, including access to stored documents, credentials, and session tokens. A patch addressing one of the issues is available in version 8.10.1. Users are advised to update when possible and exercise caution when adding content from untrusted sources.
PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability in its Live Items functionality. An authenticated administrator can inject malicious JavaScript code into the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION fields of a Live Item. This payload is stored and executed when the Live Item is viewed both in the administrative interface and on the public Live Stream page. While administrative privileges are required to inject the payload, any unauthenticated user visiting the public Live Stream page can trigger the stored script execution.
Bludit CMS version 3.22.0 contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts which execute when users view the affected content. This vulnerability can lead to unauthorized script execution in the context of the affected users.
Multiple laser printers and multifunction printers (MFPs) that use Ricoh Web Image Monitor have a reflected cross-site scripting (XSS) vulnerability. This flaw allows malicious input to be reflected in web responses, potentially enabling script execution in users' browsers when interacting with the device's web interface.
CubeCart version 6.7.4 contains a Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This vulnerability is identified as CVE-2026-54644 and is rated with medium severity.
CubeCart version 6.7.4 contains a stored cross-site scripting (XSS) vulnerability that allows malicious scripts to be stored and executed within the application context. This vulnerability is identified as CVE-2026-54645 and is classified as medium severity.
C-MOR Video Surveillance version 6.0104 and earlier contains a Cross-Site Scripting (XSS) vulnerability due to improper input sanitization of the 'size' parameter in ptzpreset.pml and the 'anyparam' parameter in show-movies.pml. An attacker can craft malicious URLs that execute arbitrary JavaScript code when visited by an authenticated user. Proof-of-concept exploit code has been published. No official patch or vendor advisory is currently available, and there is is no evidence of active exploitation in the wild.