CVE-2026-50708Disclosure

LOWCVSS 4.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the MultiSelectDialog component.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-07-07); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Fluid Attacks@fluidattacks91d
Disclosure
🚨 New zero-day in Frappe Framework | Detected by our AI SAST scanner and disclosed by Oscar Uribe. As a #CNA, we assigned the ID CVE-2026-50708. Details: 🔗https://fluidattacks.com/advisories/extremoduro. We have announced 253 #CVEs to this date: 🔗 https://fluidattacks.com/advisories/. https://t.co/LVc8B1rN4I
Post summary
The tweet announces CVE-2026-50708, a newly discovered zero‑day in Frappe Framework, and provides a link to an advisory while noting the total CVEs disclosed.
01020252
878 followersView on X
Fluid Attacks@fluidattacks90d
Disclosure
🚨 New zero-day in Frappe Framework | Detected by our AI SAST scanner and disclosed by Oscar Uribe. As a #CNA, we assigned the ID CVE-2026-50708. Details: 🔗https://fluidattacks.com/advisories/journey. We have announced 254 #CVEs to this date: 🔗 https://fluidattacks.com/advisories/. https://t.co/hUk9y6m4L4
Post summary
Fluid Attacks disclosed a new zero‑day vulnerability (CVE-2026-50708) in the Frappe Framework, publishing an advisory link. No PoC, exploit code, active exploitation, patch, or technical details were provided.
10000246
877 followersView on X

Explore more

Back to dashboard