All vulnerabilities
CVE-2026-96535

Cross-Site Scripting in the YouMind web application

YouMind YouMind web application
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in13/10/2026Fixed versionCVE List
Published13 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 13/10/2026YouMind web applicationCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN’s domain.

Text from CVE List

Affected versions 1

  • YouMind web applicationaffected: all versions before 13/10/2026CVE List

References 1