Loading story…
A critical stored cross-site scripting flaw in the open-source conference management platform pretalx exposed conference call-for-papers systems to organizer-session compromise. Tracked as CVE-2026-41241 and rated CVSS 8.7, the bug allowed low-privileged attackers to place malicious HTML or JavaScript in searchable fields including submission titles, speaker display names, usernames, and email addresses. When an organizer searched for the tainted record, the payload could execute in that organizer’s browser, enabling theft of visible data, access to CSRF tokens, and authenticated actions that effectively granted organizer-level control.
Researcher Elad Meged of Novee reported the issue after validating the vulnerable workflow across roughly 40 conferences without deploying live exploit payloads against real targets, while exploit testing was kept to controlled local environments. The report said attackers could also chain the bug with a Content Security Policy bypass by uploading a JavaScript payload disguised as presentation material, and described a no-JavaScript variant that could demote administrators via a superuser-demotion endpoint triggered from an embedded image tag. Pretalx developer Tobias Kunze said 11 findings were reported on April 14, with one deemed serious, and the project fixed the vulnerability in v2026.1.0; researchers also warned that agentic AI could help identify exposed pretalx instances and scale validation or exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Elad Meged publicly disclosed CVE-2026-41241 as a stored XSS flaw in pretalx that could enable organizer account compromise, data theft, and admin demotion. Reporting described validation across 40 conferences and outlined chained exploitation techniques, including CSP bypass and a no-JavaScript attack path.
Pretalx addressed the stored cross-site scripting vulnerability CVE-2026-41241 in April, releasing a fix in version 2026.1.0. The flaw could allow organizer-session JavaScript execution and organizer-level actions.
Pretalx developer Tobias Kunze said security researcher Elad Meged submitted 11 findings on April 14, with one later assessed as a serious vulnerability. This disclosure included the stored XSS issue later tracked as CVE-2026-41241.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenReplay fixed a critical stored cross-site scripting flaw, tracked as **`CVE-2026-55879`**, that affects versions **`1.24.0` before `1.25.0`** and can let an unauthenticated attacker take over dashboard accounts. The issue allows anyone with a public project key to submit malicious custom event names or page URLs that are stored by the platform and later rendered in the authenticated dashboard, where attacker-controlled JavaScript can execute in the dashboard origin, steal the session JWT from `localStorage`, and hijack user access. The vulnerability is rated **CVSS 9.3** and mapped to **`CWE-79`**. The remediation shipped in **OpenReplay `v1.25.0`** and was reflected in subsequent code changes that centralized output encoding for event read paths. The patch escapes event entries and nested property maps on the backend before returning data from `SearchEvents` and `GetEventByID`, and also hardens the frontend by escaping JSON shown in `EventDetailsModal`, replacing `innerHTML` with `textContent` in a text measurement helper, and adding a reusable HTML-escaping utility. Together, the changes indicate the flaw stemmed from unsanitized event content being inserted into the UI without proper output encoding.
Jul 11, 2026
Multiple high-severity vulnerabilities in **Open WebUI** allow attackers to plant malicious chat content that executes when viewed, leading to theft of JWTs and session tokens from `localStorage`, full account takeover, and compromise of sensitive AI assets. The flaws affect markdown rendering, citation and response iframe handling, and HTML file-serving paths, including cases where attacker-controlled content was rendered with dangerous HTML processing or iframe sandbox settings such as `allow-scripts allow-forms allow-same-origin`. Reported impacts include exposure of DOM data, `indexedDB`, cookies, backend API keys, model parameter files, private databases, and other enterprise AI resources. Several reports warn that if an administrator opens a malicious shared transcript or chat, the attack can escalate from stored XSS to **remote code execution** through Open WebUI's administrative features and Python-based functions or plugins, potentially yielding code execution on the Docker container or local host. The issues were addressed across releases including **v0.6.6** and **v0.7.0** by tightening file ownership checks, removing or making optional same-origin iframe access, and recommending stronger HTML sanitization and restrictive CSP settings; one report also provided a database query to hunt for stored chats containing suspicious `data:text/html` or `javascript:` embed payloads.
Jul 7, 2026
Adobe disclosed two high-severity vulnerabilities in **Adobe Connect** affecting versions **2025.3, 12.10, and earlier**, and directed customers to advisory **`APSB26-37`** for remediation. One issue, **`CVE-2026-27246`**, is a DOM-based cross-site scripting flaw classified as **`CWE-79`** that can let an attacker manipulate the browser DOM and run malicious JavaScript in a victim’s session after luring the user to a crafted webpage. The vulnerability carries a CVSS v3.1 vector of **`AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`**, indicating network reachability, low attack complexity, no privileges required, and high confidentiality and integrity impact. Adobe also disclosed **`CVE-2026-34615`**, a **`CWE-502`** deserialization of untrusted data vulnerability in the same product versions that can lead to arbitrary code execution in the context of the current user. Adobe said exploitation of the deserialization flaw does not require user interaction, making it the more serious of the two issues, while both bugs were published through Adobe’s PSIRT process and affect the same supported and earlier Adobe Connect releases. Organizations using Adobe Connect should prioritize patching exposed deployments and reviewing the vendor advisory for fixed versions and mitigation guidance.
Jun 29, 2026