Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chrome includes request-derived variables, such as request headers, form data or path values, reflect those values unencoded, allowing cross-site scripting. The default chrome does not use request variables, so only applications that add them are affected. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVEs Apache Software Foundation products: 8 critical CVEs Worst: path traversal in DirectoryResource (CVE-2026-121489) Patch → 9.2.1 https://cve.now/CVE-2026-121489?release=CVE-2026-73098,CVE-2026-73099,CVE-2026-73100,CVE-2026-73101,CVE-2026-73116,CVE-2026-73117,CVE-2026-96677&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
CVE-2026-96677 · CRITICAL · CVSS 10.0 Apache Juneau through 9.2.0 has a cross-site scripting vulnerability due to unescaped request variables in HTML document serialization. CVSS 4.0 · apache https://cve.new/CVE-2026-96677
🆕 New CVE: CVE-2026-96677 (CVSS 10.0, Enclave score 4/10) Apache Juneau · Cross-site scripting Remote, no login needed. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. https://app.enclave.ai/threat-feed/CVE-2026-96677