SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-15371

HIGH · CVSS 8.1 EPSS 0.21%

Source: NVD + CISA KEV + EPSS · Published 2026-08-18 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability in Velociraptor's web GUI affects Java applications by allowing attackers to craft malicious URLs with JavaScript schemes, leading to potential cross-site scripting (XSS) attacks. This can compromise user data and session integrity when users interact with the affected interface. Organizations using Velociraptor should prioritize patching this vulnerability to protect against potential exploitation.

CVE
CVE-2026-15371
Severity
HIGH
CVSS
8.1
EPSS
0.21%
Java

Original NVD Description

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.