CVE-2026-50980
Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record
- Published Aug 28, 2026
- CVSS 6.1 medium
- 0.4% chance of exploitation in the next 30 days (EPSS)
- A fix is available