Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters,
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-03 | 2 | Disclosure1General1 |
| 2026-06-18 | 1 | Disclosure1 |
Shynet 0.13.1 has two unauthenticated flaws: CVE-2026-35508 (critical stored XSS via the /ingress/ tracking endpoint) lets attackers inject keyloggers into every tracked site's analytics script. #DFIR_Radar https://t.co/kqW9wZg90Y
Post summary
The tweet discloses a critical stored XSS flaw (CVE-2026-35508) in Shynet 0.13.1 that allows attackers to inject keyloggers into analytics scripts via the /ingress/ tracking endpoint.
CVE-2026-35508 Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters, https://www.cve.org/CVERecord?id=CVE-2026-35508
Post summary
CVE-2026-35508 exposes a cross‑site scripting flaw in Shynet <0.14.0 template filters (urldisplay, iconify). No exploit code, patch, or active use is discussed.
⚡ New CVE Alert: CVE-2026-35508 📊 Severity: 5.4 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-35508 #CVE-2026-35508 #CVE #Medium #CyberSecurity #InfoSec https://t.co/7UpXBJflf3
Post summary
The tweet simply announces CVE-2026-35508 with a moderate severity score and references the NVD entry, providing no additional technical or exploit information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shynet | shynet | - | - | - |