Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application name or icon fields when creating an application. When a victim visits the public chat interface (/ui/chat/{access_token}), the ChatHeadersMiddleware retrieves the application data and directly inserts the unescaped application name and icon into the HTML response via string replacement. This allows an attacker to execute arbitrary JavaScript in the victim's browser context. This issue has been fixed in version 2.8.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39422 MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application name o… https://www.cve.org/CVERecord?id=CVE-2026-39422
Post summary
This brief note announces that MaxKB versions 2.7.1 and earlier are vulnerable to a stored XSS flaw via the application name field.
⚡ New CVE Alert: CVE-2026-39422 📊 Severity: 6.9 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-39422 #CVE-2026-39422 #CVE #Medium #CyberSecurity #InfoSec https://t.co/66cKdfEjCM
Post summary
A new CVE (CVE-2026-39422) has been announced with a medium severity score, but the tweet offers no details beyond the basics and lacks any information on exploitation or mitigation.
CVE-2026-39422 Stored Cross-Site Scripting in MaxKB Versions 2.7.1 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39422
Post summary
The text announces a stored cross‑site scripting vulnerability (CVE‑2026‑39422) affecting MaxKB versions 2.7.1 and older, providing affected software details but no PoC, exploit, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | maxkb | maxkb | - | - | - |