Loading story…
Apache disclosed CVE-2026-45249, an important-severity cross-site scripting flaw in Apache ECharts that affects versions prior to 6.1.0. The vulnerability is in the Lines series tooltip rendering path and is triggered when tooltips are enabled, no custom tooltip.formatter is defined, and series.data[i].name contains raw HTML that is inserted into the page through an innerHTML sink instead of being escaped.
Successful exploitation can lead to arbitrary JavaScript execution in a victim’s browser, creating risks including session token theft and account hijacking. Apache said the issue breaks the expected behavior of built-in tooltip formatting and has remediated it in Apache ECharts 6.1.0; users relying on Lines series tooltips are being urged to upgrade. The vulnerability was credited to Lakshmikanthan K and disclosed by Zhongxiang Wang on the oss-sec mailing list.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache stated that the vulnerability is remediated in Apache ECharts 6.1.0 and advised users to upgrade, especially where the Lines series and default tooltip rendering are used. The issue was credited to Lakshmikanthan K.
Apache disclosed an important-severity cross-site scripting vulnerability, CVE-2026-45249, affecting Apache ECharts versions prior to 6.1.0. The flaw occurs in Lines series tooltip rendering when unsanitized data names are inserted into an innerHTML sink, enabling script execution in a user's browser.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-66390**, an important-severity cross-site scripting vulnerability in **Apache Wicket** caused by improper neutralization of input during web page generation. The flaw allows crafted `Link` URL strings to break out of an intended JavaScript sequence, creating a path for script injection in affected web applications built on the framework. The issue affects Apache Wicket versions **9.0.0 through 9.23.0** and **10.0.0 through 10.9.0**. A security notice published on the `oss-sec` mailing list advised users to remediate by upgrading to **Apache Wicket 10.10.0**, making patch validation and exposure review a priority for organizations running Wicket-based applications.
Jul 27, 2026
Apache disclosed five vulnerabilities in **Apache Answer** affecting versions through `2.0.0`, including a **critical** cross-site scripting issue tracked as `CVE-2026-25688`. The XSS flaw stems from insufficient sanitization of AI-generated answer content, allowing malicious script execution when users view affected pages. Apache also fixed `CVE-2026-25699`, an authorization bypass in timeline-related APIs that let authenticated users access deleted, private, or unapproved content and related revision history, potentially exposing personal information, and `CVE-2026-25700`, which left previously issued administrative tokens valid after an administrator account was suspended, deleted, or deactivated. The same release also addressed `CVE-2026-33582`, a denial-of-service bug in which a specially crafted TIFF upload could trigger excessive memory allocation and crash the server process, and `CVE-2026-34033`, which allowed authenticated users to inject arbitrary HTML into notification emails because script-related tags were not properly neutralized. Apache said all five issues are remediated in **Apache Answer `2.0.1`** and advised users to upgrade, with reports credited to Sho Odagiri, Reimar Fritz, and Andy Gill of ZephrSec Ltd.
Jun 29, 2026
The Apache Software Foundation released security updates for *Apache Syncope* to address vulnerabilities that could enable **session hijacking** and **sensitive data exposure** in identity-management deployments. One issue, **CVE-2026-23794**, is a **reflected XSS** flaw in the **Enduser Login** page where an attacker can trick a user into clicking a crafted link, leading to arbitrary JavaScript execution in the victim’s browser and potential theft of session cookies or actions performed as the user. A second issue, **CVE-2026-23795**, is an **XML External Entity (XXE)** vulnerability in the **Syncope Console** related to creating/editing **Keymaster parameters**; it requires an attacker to have (or obtain) administrator-level entitlements, but can then be used to submit malicious XML to trigger data leakage and potentially facilitate session compromise. Reported affected versions include **3.0–3.0.15** and **4.0–4.0.3**, with fixes available in **3.0.16** and **4.0.4**; organizations running impacted releases are advised to upgrade promptly, particularly given Syncope’s role in authentication and access control.
Jun 29, 2026