Loading story…
A stored cross-site scripting flaw tracked as CVE-2026-63135 was disclosed in YOURLS, affecting versions 1.5.1 through 1.10.3. The vulnerability allows an unauthenticated attacker to place malicious JavaScript in a crafted HTTP Referer header, which YOURLS logs and later renders in shortened-URL statistics pages. When an administrator views those stats, the attacker-controlled value can execute in the browser because referrer data was interpolated into inline Google Charts JavaScript without proper escaping.
The issue was fixed in YOURLS 1.10.4 through security changes merged under pull request #4107 and commit e1e93476655107e6caab34e52259eb1c91079ec7. The patch strengthens yourls_get_domain() with stricter host validation, rejects malformed and unsafe inputs including javascript: and data: URIs, and adds escaping in favicon URL generation and JavaScript data table construction. The reported impact includes administrator session hijacking, redirect manipulation, and theft of the admin's static API signature token; the flaw is mapped to CWE-79 and carries a CVSS v3.1 score of 8.2.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The coordinated disclosure states that the fixed YOURLS release 1.10.4 was published on 2026-05-21, addressing the stored XSS vulnerability later identified as CVE-2026-63135. The flaw affected versions 1.5.1 through 1.10.3.
YOURLS merged commit e1e9347 titled "Prevent XSS in stat pages through referrers," adding escaping in JavaScript chart generation, stricter domain validation, and new tests. The commit was authored and merged on May 21, 2026.
YOURLS tracked the referrer-based XSS issue in pull request #4107, marked it as verified, applied a security label, and added it to the 1.10.4 milestone. These triage actions are explicitly dated May 20, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity stored cross-site scripting vulnerability, **GHSA-7w8c-qgxg-m7jx** (CWE-79), affects LibreNMS legacy PHP templates that render monitoring data without consistent output encoding. Attackers able to control SNMP metadata, spoof Syslog messages, or supply crafted BGP descriptions can store JavaScript payloads that execute when administrators view device-health, routing, or event-log pages, potentially compromising administrator browser sessions and enabling session takeover. Organizations should update LibreNMS and related packages to version **26.5.0** or later; Tenable Cloud Security plugin **446367** can identify affected `librenms/librenms` deployments. Developers should apply contextual output encoding, including Laravel's `e()` helper or escaped Blade `{{ ... }}` syntax rather than raw output, and deploy a restrictive Content Security Policy as defense in depth. No known exploitation has been reported.
Aug 26, 2026
A high-severity stored cross-site scripting flaw, tracked as **CVE-2026-71285**, was disclosed in **Uptime Kuma**, the self-hosted monitoring tool maintained in the `louislam/uptime-kuma` project. The vulnerability affects versions up to and including **2.4.0** and stems from the product's Matomo analytics integration, where the admin-configurable `siteId` is inserted into a JavaScript block on public status pages without proper neutralization of characters such as `]`, `)`, `;`, and `(`. An attacker with **editor or admin access** can store a malicious value such as `1]);alert(document.cookie)//`, which then executes arbitrary JavaScript when unauthenticated users visit `/status/<slug>` pages. The issue is rated **CVSS 8.1** with vector `AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N`, and reported impact includes session-cookie theft and full compromise of the rendered page; recommended remediation is to validate and escape the Matomo `siteId` input and update Uptime Kuma to a fixed release.
Aug 5, 2026
A stored DOM-based cross-site scripting flaw tracked as **`CVE-2026-65592`** affects the n8n workflow automation platform, allowing authenticated users with workflow creation or editing rights to plant a malicious URI in the Resource Locator component's **`cachedResultUrl`** field. The value is saved in workflow metadata and later passed to **`window.open()`** without validating the URL scheme, so a victim who opens the crafted workflow and clicks the external resource link can trigger attacker-controlled JavaScript in their browser. The vulnerability affects n8n versions before **`1.123.64`**, before **`2.29.8`**, and before **`2.30.1`**. Reports say the bug could enable session hijacking or abuse of n8n API access available to the victim user, and classify the issue as **CWE-79** with network attackability, low attack complexity, low privileges required, and user interaction required. Recommended remediation is to upgrade to a fixed release and enforce strict scheme validation so only safe **`http`** and **`https`** URLs are accepted in **`cachedResultUrl`**.
Jul 23, 2026