NVD HIGH: CVE-2026-67352 — luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in...

Saturday, August 1, 2026 at 01:17 PM UTC·Source: NIST NVD

Updated: Monday, August 3, 2026 at 01:00 PM UTC

Executive Summary

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-67352

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Aug 1, 2026. Verified by: NIST.

Related Threats

LOWVulnerability

HollowFrame Loader Uses Fake Python DLL to Evade Defender

New HollowFrame loader hid Go code in a fake Python DLL after pre-staging Defender exclusions

1h agoInfosecurity Magazine

MEDIUMVulnerability

BBVA acquires SocGen's 50% stake in brokerage joint venture Altura Markets

BBVA has reached an agreement with Société Générale (SG) to integrate Altura Markets into the BBVA Group by acquiring the 50 percent stake currently owned by the French bank, becoming the company's sole shareholder. The transaction is subject to the relevant regulatory approvals.

1h agoFinextra

MEDIUMVulnerability

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most of which are fake Amazon Web Services (AWS) sign-in pages on a domain that also hosts the exploit toolkit. "

2h agoThe Hacker News