CVE-2026-44956

Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system‑generated emails, whose content is stored in the details field of the userlog table. An admin user viewing the email content through userlog-details.php would have any malicious JavaScript payload executed due to missing output sanitisation. Proper escaping has been added to the userlog details output.

• CWE-79

• https://hackerone.com/reports/3669623

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44946A SAML authentication replay vulnerability in Rancher's Asse…7.4
• CVE-2026-44947A missing clean-up in the legacy Project Role Template Bindi…6.9
• CVE-2026-44948A path traversal vulnerability was found in Fleet's ImageSca…5.3
• CVE-2026-44949A Rancher FleetWorkspace admission path allowed side effects…7
• CVE-2026-4495A security flaw has been discovered in atjiu pybbs 6.0.0. Th…3.5
• CVE-2026-44955Pronetiqs IntraVUE versions 3.2.1a14 and prior have an expos…6.9
• CVE-2026-44957A missing access control check when invoking various modify …4.3
• CVE-2026-44958An access control bypass allows an advertiser‑level user to …5.4
• CVE-2026-44959A missing validation of user input exists when saving delive…8.8
• CVE-2026-4496A vulnerability was found in sigmade Git-MCP-Server up to 78…5.3
• CVE-2026-44960A stored XSS can be exploited by leveraging the usernames as…0
• CVE-2026-44961The XML‑RPC API addUser method has a validation bypass intro…0