CVE-2025-26766

Summary

CVE-2025-26766 is a Cross-site Scripting (XSS) vulnerability affecting the VaultDweller Leyka software. The flaw, which permits Stored XSS, is due to improper neutralization of user input during web page generation. This issue poses a security risk as an attacker could inject malicious scripts into web pages viewed by other users, potentially leading to data theft or unauthorized actions. The vulnerability impacts versions of Leyka from n/a through 3.31.8. Users are advised to apply the appropriate security patches to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.