CVE-2026-67444

Hubleys , a dashboard for self-hosted services, is vulnerable to Stored XSS prior to version 0.5.2 . An authenticated non-admin user can upload a file with an arbitrary extension as a dashboard "background image." The server serves this file back with a Content-Type derived directly from the atta...