XSS

Four authenticated vulnerabilities in Satel Netco Design below v2.1.7 enable stored XSS, regex DoS, file enumeration, and arbitrary code execution via path traversal. All four flaws require authentication with Viewer or Network Operator privileges. CVE-2026-101024 (CVSS 8.8) is most severe, enabling arbitrary file writes and potential code execution through data export path traversal. Update to v2.1.7 to remediate all issues.

OpenPLC Runtime v3 contains a cross-site scripting vulnerability (CVE-2026-88020) enabling session hijack and PLC control; upgrade to v4. CVE-2026-88020 is a CWE-79 XSS flaw in OpenPLC Runtime v3's web interface caused by unencoded query string parameters. Successful exploitation hijacks operator sessions, allowing state-changing requests that control the PLC and physical processes.

TA488, a Russia-aligned threat actor linked with medium confidence to Void Blizzard/Laundry Bear, exploited a zero-day flaw (CVE-2025-66376) in Zimbra's client-side HTML sanitizer using a tag-splitting technique with fake CSS @import directives to smuggle executable SVG/JavaScript payloads. The resulting malware, ZimReaper, requires only that a victim open/preview a crafted email in vulnerable Zimbra webmail to execute in the browser context, harvesting CSRF tokens, autofill credentials, and 2FA codes, establishing a persistent app-specific password bypassing MFA, and exfiltrating Global Address List data and up to 90 days of email via DNS tunneling and HTTP POST to Cloudflare-fronted C2 infrastructure. Targeting focused on Ukrainian government and US government/science/defense industrial base entities, with the campaign going dormant after public disclosure by Seqrite in early 2026.

ABB EIBPORT building management systems running firmware prior to version 3.9.2 contain a high-severity Cross-Site Scripting (XSS) vulnerability (CVE-2021-22291). Successful exploitation allows attackers to steal session IDs, leading to unauthenticated device access, sensitive information disclosure, and unauthorized configuration changes.

CISA has added CVE-2026-42897, a Cross-Site Scripting (XSS) vulnerability in Microsoft Exchange Server, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. Organizations are strongly urged to prioritize remediation of this flaw to reduce exposure to cyberattacks.

The Canadian Centre for Cyber Security issued advisories for critical vulnerabilities in Drupal core and Nginx UI. Notably, the Nginx UI vulnerability (CVE-2026-33032) is currently being exploited in the wild, requiring immediate patching and monitoring of exposed management interfaces.

2026-05-135 minVaronishigh

Agentic LLM browsers introduce novel architectural vulnerabilities by bridging traditional web sandboxes with highly privileged AI agents. Attackers can exploit trusted origin models via XSS or prompt injection to hijack these agents, enabling unauthorized browser control, data exfiltration, and local file access.