CVE-2026-50571 WebSub: Reflected script execution through intent-verification challenges

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the hub.challenge value, also exposed as hubchallenge by some frameworks, but does not require safe response media typing ...

CVE-2026-50571

The WebSub protocol (REC-websub-20180123) is vulnerable to reflected script execution because the intent-verification protocol requires echoing the hub.challenge value without requiring safe response media typing or disabled MIME sniffing. An attacker can redirect a victim to a crafted verificati...

CVE-2026-50571 WebSub: Reflected script execution through intent-verification challenges

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the hub.challenge value, also exposed as hubchallenge by some frameworks, but does not require safe response media typing ...

CVE-2026-50571 WebSub: Reflected script execution through intent-verification challenges

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the hub.challenge value, also exposed as hubchallenge by some frameworks, but does not require safe response media typing ...

CVE-2026-54221

UBB.threads is affected by a Reflected XSS vulnerability (CVE-2026-54221). The issue is confirmed in version 7.7.5 and may affect other versions. The vulnerability allows an attacker to execute arbitrary JavaScript in a victim’s browser when the user clicks a crafted link, with user interaction r...

CVE-2026-27512

Affected product/firmware: Shenzhen Tenda F3 Wireless Router, firmware V12.01.01.55_multi. Issue: Content-type confusion in the administrative interface where responses omit the X-Content-Type-Options: nosniff header and reflect attacker-influenced content into the response body. MIME sniffing ma...

CVE-2022-30680

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...