CVE-2026-15371

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description The web GUI allows the specification of custom column types for tables. When the URL type is used, the system forms a clickable link from the cell value. Because the code does not restrict the allowed URL schemes, an attacker can use a JavaScript scheme to execute a Cross-Site Scripting (XSS) attack, which occurs when malicious scripts are injected into trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.