CVE-2026-55592
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly t
CVSS
3.9
Low
EPSS
0.3%
p21
KEV
—
Exploit Today
6
0-100
Published: Jul 7, 2026 · Last modified: Jul 8, 2026 · CWE-79
0.3%EPSS · 30 days0.3%
2026-08-092026-09-05
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.
- github.comhttps://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b
- github.comhttps://github.com/lissy93/dashy/releases/tag/4.3.7
- github.comhttps://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc
- github.comhttps://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-862263.5 LOW—
———A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.4hCVE-2026-862164.3 MED—
———A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.12hCVE-2026-861813.5 LOW—
——0A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used.17hCVE-2026-842197.5 HIG—
——0The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.15hCVE-2026-840286.8 MED—
——0The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.15hCVE-2026-86197——
——0Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.2d