Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 4.8.0 mitigates this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-6493 A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-pas… https://www.cve.org/CVERecord?id=CVE-2026-6493
Post summary
A new vulnerability (CVE-2026-6493) has been identified in lukevella rallly 4.7.4 affecting a reset‑password component, but no further technical or remediation details are provided.
CVE-2026-6493 Cross Site Scripting in lukevella rallly Up To Version 4.7.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6493
Post summary
A new cross‑site scripting vulnerability, CVE‑2026‑6493, is reported for lukevella rallly up to version 4.7.4, with details available on vulmon.