A new vulnerability, CVE-2026-26278, has been identified. While a regex injection issue was previously reported by ochk0, this is a separate denial-of-service (DoS) flaw that can severely impact server availability.
https://t.co/V6eYyJChYd
https://t.co/FRZi1rXULH
CVE-2026-27469 — Stored XSS in isso-comments/isso. Single quote escaping gap in website field leads to script execution via innerHTML injection.
https://t.co/Bhd5rw7SRu
https://t.co/NKwxOJNsNO
Turns out like 10 people found the same vulnerability :)
I counted 6 different payloads, 5 of them I found independently, 6th one was found by folks from JFrog.
My writeup: https://t.co/zyyYWfOYnZ