{"vulnerability": "CVE-2026-96535", "sightings": [{"uuid": "c9a97c1a-06e6-4903-92c6-668f49556e87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-96535", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117432798430921080", "content": "CVE-2026-96535 Cross-Site Scripting in the YouMind web application Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN\u2019s domain.\nhttps://www.cve.org/CVERecord?id=CVE-2026-96535https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-youmind-web-application#YouMind #YouMindwebapplication#CVE_2026_96535#bot", "creation_timestamp": "2026-10-13T09:05:00.699577Z"}]}