Product
A public proof-of-concept (PoC) exists for CVE-2026-38903, an unauthenticated remote HTML injection vulnerability in Alertus Desktop Alert v5.4.98.0. The vulnerability stems from a certificate validation bypass that allows attackers to render arbitrary HTML and execute JavaScript within a Trident WebBrowser control.