Loading story…
CERT Polska disclosed CVE-2026-40126, a DOM-based cross-site scripting flaw in OutSystems Service Center that affects all versions before 11.41.2. The vulnerability can be triggered by a low-privileged attacker who uploads a file with a filename containing malicious JavaScript, allowing script injection in areas where files are attached and prepared for upload to the server.
OutSystems has fixed the issue in Service Center 11.41.2. CERT Polska said it coordinated disclosure of the bug, and credited Zbigniew Piotrak of the AFINE Team with responsibly reporting the vulnerability; a separate security notice amplified the advisory but did not add exploitation or impact details beyond the CERT disclosure.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CERT Polska published CVE-2026-40126 on 17 August 2026, disclosing a DOM-based cross-site scripting vulnerability in OutSystems Service Center. The notice states the issue is classified as CWE-79 and can be exploited through malicious filenames in file upload workflows.
OutSystems remediated CVE-2026-40126 in Service Center version 11.41.2. The vulnerability affects all versions before 11.41.2.
Zbigniew Piotrak of the AFINE Team responsibly reported a DOM-based cross-site scripting vulnerability in OutSystems Service Center to CERT Polska, which then coordinated disclosure. The flaw allows a low-privileged attacker to inject JavaScript via a malicious filename during file upload preparation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dassault Systèmes disclosed two high-severity stored cross-site scripting vulnerabilities, `CVE-2025-10551` and `CVE-2025-10553`, affecting Document Management in **ENOVIA Collaborative Industry Innovator** and Factory Resource Management in **DELMIA Factory Resource Manager**. Both flaws impact **3DEXPERIENCE** releases from `R2023x` through `R2025x` and could let an authenticated attacker inject malicious content that executes arbitrary script code in another user's browser session. The vulnerabilities are classified as **CWE-79** and carry the same CVSS v3.1 vector, `AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`, indicating network-based exploitation with low attack complexity, required low privileges, and user interaction. Vendor references point to Dassault Systèmes security advisories, and the impact profile highlights potential compromise of confidentiality and integrity within affected browser sessions.
Jun 29, 2026
Magnolia CMS was found to contain a stored cross-site scripting vulnerability, tracked as **CVE-2026-18478**, that allows an attacker with editor privileges to inject arbitrary HTML and JavaScript through the name of an uploaded image. The payload is stored by the application and executes when the uploaded image is later opened, creating a path for session theft, unauthorized actions, or further compromise within Magnolia DXP environments. The flaw affects **Magnolia CMS 6.3.0 through 6.3.10**. **CERT Polska** said it received the report and coordinated disclosure, crediting **Kacper Paluch** and **Łukasz Sobański** for responsible reporting. Magnolia addressed the issue in **version 6.3.10**, and organizations using affected releases should verify they are running the fixed version and review editor-access workflows where untrusted content can be uploaded.
Aug 10, 2026
Adobe disclosed two high-severity vulnerabilities in **Adobe Connect** affecting versions **2025.3, 12.10, and earlier**, and directed customers to advisory **`APSB26-37`** for remediation. One issue, **`CVE-2026-27246`**, is a DOM-based cross-site scripting flaw classified as **`CWE-79`** that can let an attacker manipulate the browser DOM and run malicious JavaScript in a victim’s session after luring the user to a crafted webpage. The vulnerability carries a CVSS v3.1 vector of **`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`**, indicating network reachability, low attack complexity, no privileges required, and high confidentiality and integrity impact. Adobe also disclosed **`CVE-2026-34615`**, a **`CWE-502`** deserialization of untrusted data vulnerability in the same product versions that can lead to arbitrary code execution in the context of the current user. Adobe said exploitation of the deserialization flaw does not require user interaction, making it the more serious of the two issues, while both bugs were published through Adobe’s PSIRT process and affect the same supported and earlier Adobe Connect releases. Organizations using Adobe Connect should prioritize patching exposed deployments and reviewing the vendor advisory for fixed versions and mitigation guidance.
Jun 29, 2026