CVE-2026-44960

A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation. Proper escaping has been added to the audit log details output.

• CWE-79

• https://hackerone.com/reports/3680090

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44955Pronetiqs IntraVUE versions 3.2.1a14 and prior have an expos…6.9
• CVE-2026-44956Low‑privileged users could use their Full Name as a vector f…0
• CVE-2026-44957A missing access control check when invoking various modify …4.3
• CVE-2026-44958An access control bypass allows an advertiser‑level user to …5.4
• CVE-2026-44959A missing validation of user input exists when saving delive…8.8
• CVE-2026-4496A vulnerability was found in sigmade Git-MCP-Server up to 78…5.3
• CVE-2026-44961The XML‑RPC API addUser method has a validation bypass intro…0
• CVE-2026-44962Plesk contains an XPath injection vulnerability in the APS A…9.9
• CVE-2026-44963A vulnerability allowing remote code execution (RCE) on the …9.4
• CVE-2026-44964In versions of the Datadog Android application prior to v545…6.5
• CVE-2026-44965In versions of the Datadog Android application prior to v545…5.5
• CVE-2026-44966Velocity.js is a JavaScript implementation of the Apache Vel…9.8