Skip to content
Threat Feed
Subscribe

Vendor

Alertus

1 brief RSS
medium advisory

Alertus Desktop Alert: Unauthenticated Remote HTML Injection (CVE-2026-38903)

A public proof-of-concept (PoC) exists for CVE-2026-38903, an unauthenticated remote HTML injection vulnerability in Alertus Desktop Alert v5.4.98.0. The vulnerability stems from a certificate validation bypass that allows attackers to render arbitrary HTML and execute JavaScript within a Trident WebBrowser control.

Desktop Alert HTML injection certificate validation bypass
1c