Skip to content
Threat Feed
Subscribe

Tag

Dom-Xss

3 briefs RSS
high advisory

Wetty Client DOM XSS via Base64 Filename in File Download Escape Sequence (CVE-2026-49864)

A high-severity DOM XSS vulnerability (CVE-2026-49864) in the wetty SSH client allows an attacker to achieve keystroke injection and command execution on the victim's SSH session by embedding a crafted base64-encoded filename within a terminal file-download escape sequence, which is then unescaped and rendered as raw HTML.

wetty xss dom-xss vulnerability rce ssh-client client-side
1r 4t
high advisory

ethyca-fides fides.js DOM-based XSS Vulnerability

A DOM-based XSS vulnerability (CVE-2026-44541) exists in ethyca-fides' fides.js script, allowing arbitrary JavaScript execution in the embedding site's origin via crafted links when HTML-formatted descriptions are enabled.

fides.js +1 xss dom-xss ghsa ethyca-fides
2r 1t
high advisory

locize Client SDK Cross-Origin DOM XSS and Handler Hijack Vulnerability

The locize client SDK versions prior to 4.0.21 are vulnerable to cross-origin DOM XSS and handler hijack due to missing origin validation in the InContext Editor, allowing attackers to inject malicious code and exfiltrate data via crafted postMessage events.

locize client SDK xss dom-xss postMessage locize javascript
2r 1t