Topic
12 articles
CyberSecureToday covers Cross-Site Scripting across 12 articles published between 22 Sep 2026 and 12 Nov 2026.
The coverage includes 11 vulnerability advisories and 1 analysis or guidance piece. 11 advisories are rated critical or high severity.
Stories on Cross-Site Scripting most often intersect with Vulnerability Analysis, Patch & Fix and SunEditor, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Microchip Stored cross-site scripting vulnerability in Micro Cross-Site Scripting Flaw Disclosed (CVE-2026-8333)”, was published 12 Nov 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
Threat IntelCVE-2026-8333 in Microchip Stored cross-site scripting vulnerability in Micro (Cross-Site Scripting) allows remote attackers to trigger arbitrary code exec
Threat IntelCVE-2026-126800 in Hydro @hydrooj/ui-default (Cross-Site Scripting) allows remote attackers to trigger arbitrary code execution. Patch: Version 4.59.1 and
Threat IntelCVE-2026-126806 in WWBN AVideo (Cross-Site Scripting) allows remote attackers to trigger arbitrary code execution. Patch: Version 29.7.1 and later.
Threat IntelCVE-2026-124463 in OpenEMR (Cross-Site Scripting) allows remote attackers to trigger arbitrary code execution. Patch: Version 8.3.0 and later.
Threat IntelCVE-2026-124494 in SunEditor (Cross-Site Scripting) allows remote attackers to trigger arbitrary code execution. Patch: Version 3.4.0 and later.
Threat IntelCVE-2026-124493 in SunEditor (Cross-Site Scripting) allows remote attackers to trigger arbitrary code execution. Patch: Version 3.4.0 and later.
Threat IntelCVE-2026-96677 in Improper Neutralization of Input During Web Page G (Cross-Site Scripting) allows remote attackers to trigger arbitrary code execution. Pa
Threat IntelCVE-2026-82158 in Dell Wyse Management Suite, versions (Cross-Site Scripting) allows remote attackers to trigger arbitrary code execution. Patch: Version 2
Agentic AIA critical P1 vulnerability in ChatGPT's shared-conversation feature allowed attackers to execute arbitrary scripts in victim sessions to exfiltrate private chats.
Threat IntelA stored cross-site scripting flaw in Mozilla Pontoon public dashboards allowed malicious contributor addresses to execute arbitrary code in reviewer sessions.
OT / SCADACISA warns of CVE-2026-88020 in OpenPLC Runtime v3 web interface, allowing attackers to hijack operator sessions and manipulate physical industrial processes.
OT / SCADASiemens and CISA issue advisory ICSA-26-258-07 for CVE-2026-58113 in Teamcenter PLM, where reflected XSS in authentication redirects allows remote attackers to hijack CAD sessions.