Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, an authenticated attacker can inject malicious JavaScript into their Open XDMoD user profile and abuse the password reset functionality to email a link to an HTML page, which when visited by the victim, reflects and executes the unsanitized payload in the victim's browser, potentially leading to credential capture and Open XDMoD account takeover. All deployments of Open XDMoD prior to 11.0.3 are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-45778 OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, an authenticated attacker can inject malicious JavaScript into their… https://www.cve.org/CVERecord?id=CVE-2026-45778
Post summary
The CVE discloses an authenticated JavaScript injection flaw in OpenXDMoD versions before 11.0.3, with no PoC or exploit code public and no reported active exploitation.
CVE-2026-45778 Reflected Cross-Site Scripting in OpenXDMoD Prior to Version 11.0.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45778
Post summary
The text refers to CVE‑2026‑45778 as a reflected XSS in OpenXDMoD prior to 11.0.3, but provides no evidence of exploitation, patching, or proof of concept.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | buffalo | open_xdmod | - | - | - |