CVE-2026-126954

The Glance application (versions 0.7.9 before 0.8.8 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of proper input neutralization, allowing malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. An attacker contr...