CVE-2026-66824
A critical cross‑site scripting flaw exists in the capture tree visualization page of an application. The flaw allows an attacker to inject malicious code that runs in the browser of anyone viewing the affected page.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
The vulnerability affects the capture tree visualization page of the application; no specific product versions are listed in the data.
Real-world impact
If exploited, an attacker can run arbitrary JavaScript in the victim’s browser, enabling them to act with the victim’s authenticated session, steal or alter data, or perform other malicious actions within the victim’s permissions.
Why this severity
The CVSS score of 9.2 reflects the high impact of the flaw: it is exploitable over the network, requires no user interaction, and can lead to complete compromise of the victim’s session and data.
What to do about it
- 01Apply the vendor patch that removes the JSON data from the HTML document and retrieves it through a dedicated API endpoint, preventing the data from being interpreted as executable content.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.