These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
This debrief provides an executive overview of CVE-2026-106706, a stored cross-site scripting (XSS) vulnerability in the GLUE code editor of XXL-JOB through version 3.5.0-SNAPSHOT. The vulnerability allows for potential attacker-controlled script execution in the context of users interacting with the GLUE code editor. Defenders should assess exposure, prioritize patching or mitigation, and monitor for pot [truncated]
A vulnerability was found in xuxueli xxl-job up to 3.4.2/3.5.0, affecting the Task Management Interface. The manipulation of the argument name/author leads to cross-site scripting. This issue can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond. Defenders should assess the risk of cross-site scripting a [truncated]
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. Defenders responsible for Xuxueli xxl-job instances, especially those using version 3.5.0 or earlier, should assess their exposure to this vulnerability and prior [truncated]
A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of hard-coded cryptographic key. It is possible to launch the attack remotely. A high complexi [truncated]
A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to [truncated]
A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2, impacting the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote and is characterized by high complexi [truncated]