CVE-2026-15371

creationtimestamp| type| source ---|---|--- 2026-08-18 08:21:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6inycnsz4vsf6 2026-08-18 09:46:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtdwoh2tbx2h...

CVE-2026-15371 Velociraptor Stored XSS in URL column types

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...