Mixer2 Buzz Comments vulnerabilities

• mixer2 buzz comments Buzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting CVE-2026-6041 4.4 MediumApril 22, 2026