Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload endpoint (POST /api/v1/archives/[linkId]?format=4) accepts HTML files (text/html) without sanitizing JavaScript content. When the archive is later accessed via GET /api/v1/archives/[linkId]?format=4, the HTML is served with Content-Type: text/html from the Linkwarden origin, without any Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of the authenticated Linkwarden sessio. At time of publication, there are no publicly available patches.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚡ New CVE Alert: CVE-2026-42455 📊 Severity: 8.8 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-42455 #CVE-2026-42455 #CVE #High #CyberSecurity #InfoSec https://t.co/8FH4G6mUDm
Post summary
A new high‑severity vulnerability, CVE‑2026‑42455, is announced with an 8.8 CVSS score, but no further technical or mitigation details are included.
CVE-2026-42455 Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload en… https://www.cve.org/CVERecord?id=CVE-2026-42455
Post summary
The text briefly references CVE‑2026‑42455 within the context of the Linkwarden project but gives no additional technical or practical details.
CVE-2026-42455 Stored Cross-Site Scripting in Linkwarden 2.14.0 and Prior Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42455
Post summary
A new stored XSS vulnerability (CVE‑2026‑42455) has been disclosed for Linkwarden 2.14.0 and earlier versions.