{"vulnerability": "CVE-2026-6182", "sightings": [{"uuid": "94dd966c-03ac-45c7-beac-403dbafc8f34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6182", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjfkbpydvk2m", "content": "", "creation_timestamp": "2026-04-13T18:57:54.623662Z"}, {"uuid": "0d57de25-52ef-4e82-b094-afa00a35d71e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6182", "type": "seen", "source": "Telegram/mgx4OESgILIX0WlIlJJnUrKrutJBiy7rqG6NL0bWgANWmeU", "content": "", "creation_timestamp": "2026-04-13T18:01:43.000000Z"}, {"uuid": "45f298c2-aa82-4e24-8b6a-e47eed1f746a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61826", "type": "published-proof-of-concept", "source": "https://t.me/nxblog/1758", "content": "\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0434 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u043c\u0435\u043d\u044f \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0446\u0432\u0435\u0448\u043a\u0430, CVE-2026-61826!!!!\n10.0 Critical \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043b\u0438 \u2764\ufe0f\n\n\nhttps://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4", "creation_timestamp": "2026-08-01T20:00:05.927522Z"}, {"uuid": "a25a4ae1-27b2-4237-83fe-e4a4e8829637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61824", "type": "seen", "source": "https://gist.github.com/alon710/b7fa1b8a029c3e91e2e782156a414d06", "content": "# CVE-2026-61824: CVE-2026-61824: High-Severity Cross-Site Scripting (XSS) via Unsanitized Site Extractors in Defuddle\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61824\n\n## Summary\nCVE-2026-61824 is a high-severity Cross-Site Scripting (XSS) vulnerability in kepano/defuddle before version 0.19.1. Custom site extractors for platforms such as X/Twitter, Substack, and YouTube constructed HTML representations via template string interpolation without output escaping. This allowed malicious pages to bypass standard parser sanitization routines and execute arbitrary JavaScript.\n\n## TL;DR\nUnsanitized input interpolation in site extractors allows remote attackers to execute arbitrary client-side JavaScript via crafted page metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **Exploit Status**: Proof-of-Concept in tests\n- **KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- kepano/defuddle applications scraping Twitter, Substack, or YouTube\n- **defuddle**: < 0.19.1 (Fixed in: `0.19.1`)\n\n## Mitigation\n\n- Upgrade defuddle to version 0.19.1 or higher.\n- Implement mandatory downstream HTML sanitization using DOMPurify or sanitize-html.\n- Enforce a strict Content Security Policy (CSP) blocking inline scripts.\n\n**Remediation Steps:**\n1. Run 'npm install defuddle@0.19.1' or update package.json dependencies.\n2. Locate all locations in the codebase where Defuddle's output is rendered into the DOM.\n3. Wrap the output rendering block in a robust sanitization function call.\n4. Verify that inline events like 'onerror' and 'onclick' are fully stripped.\n\n## References\n\n- [GHSA-jg4p-g6xj-4qmf: XSS via unescaped attribute interpolation in site extractors](https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf)\n- [GitHub Pull Request #326](https://github.com/kepano/defuddle/pull/326)\n- [Defuddle v0.19.1 Release](https://github.com/kepano/defuddle/releases/tag/0.19.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61824) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T08:32:19.247754Z"}, {"uuid": "801bbe53-f916-4c38-b501-1900b90f2484", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61824", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmxucky752o", "content": "\ud83d\udfe0 CVE-2026-61824 - High (8.2)\n\nDefuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image al...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61824/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T00:01:31.980055Z"}, {"uuid": "7d57cd9d-a237-45ee-a5cf-58f8986855d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61826", "type": "seen", "source": "https://t.me/nxblog/1758", "content": "\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0434 \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0447\u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u043c\u0435\u043d\u044f \u0435\u0441\u0442\u044c \u0435\u0449\u0435 \u043e\u0434\u043d\u0430 \u0446\u0432\u0435\u0448\u043a\u0430, CVE-2026-61826!!!!\n10.0 Critical \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043b\u0438 \u2764\ufe0f\n\n\nhttps://github.com/morpheus65535/bazarr/security/advisories/GHSA-fvcv-hh55-x3r4", "creation_timestamp": "2026-07-29T08:01:20.519498Z"}, {"uuid": "ba4d94dd-0e9b-4cc2-b441-8d18ba800f78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61820", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxv3dkkem2r", "content": "\ud83d\udfe0 CVE-2026-61820 - High (8.5)\n\npg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61820/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-20T19:01:42.564585Z"}, {"uuid": "6c30c393-e0fc-4983-ad0c-d80f0a41160a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61821", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxv3si2mz2w", "content": "\ud83d\udfe0 CVE-2026-61821 - High (8.5)\n\npg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61821/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-20T19:01:43.865298Z"}, {"uuid": "f6deb901-066a-4a38-bccc-510e4df17b06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61821", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117328183504581185", "content": "CVE-2026-61821 pg_partman: drop_partition_id/time allow privilege escalation to superuser via retention_schema. CVSS 8.5, unpatched. patch to 5.5.0 now https://www.valtersit.com/cve/CVE-2026-61821/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-24T21:40:15.677224Z"}, {"uuid": "81c18497-1fd0-48c9-8952-c05f0ea4f261", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61821", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwcawjmjj42f", "content": "CVE-2026-61821 pg_partman: drop_partition_id/time allow privilege escalation to superuser via retention_schema. CVSS 8.5, unpatched. patch to 5.5.0 now https://www.valtersit.com/cve/CVE-2026-61821/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-24T22:00:07.694594Z"}, {"uuid": "b000e22b-39c9-468c-8274-01cc971827cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61825", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwd4pjdgb32d", "content": "\ud83d\udfe0 CVE-2026-61825 - High (8.7)\n\ncode16 Sharp is a Laravel-based framework for building content-management and administrative inte...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61825/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T06:17:18.085629Z"}, {"uuid": "b35b2ff1-8b68-4adb-9ce7-8ea8700802a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61820", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117331882345082445", "content": "CVE-2026-61820: pg_partman pre-5.5.0 SQL injection via unescaped PK column names. CVSS 8.5. No patch confirmed. Update now. https://www.valtersit.com/cve/CVE-2026-61820/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-25T13:20:46.516365Z"}, {"uuid": "e341df13-4d71-4b2d-a77b-07301ec0ba16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61820", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwduvntklf27", "content": "CVE-2026-61820: pg_partman pre-5.5.0 SQL injection via unescaped PK column names. CVSS 8.5. No patch confirmed. Update now. https://www.valtersit.com/cve/CVE-2026-61820/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-25T13:30:13.130521Z"}, {"uuid": "017b2c21-65f6-48ff-b0a7-41276f76fce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61823", "type": "seen", "source": "https://gist.github.com/alon710/4cf0072fd72e5b7220c9b813b7fb1aa2", "content": "# CVE-2026-61823: CVE-2026-61823: Stored Cross-Site Scripting (XSS) via iframe srcdoc Attribute in code16 Sharp\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61823\n\n## Summary\nA stored cross-site scripting (XSS) vulnerability was identified in the content-management and administrative framework code16 Sharp. The flaw stems from an overly permissive HTML sanitization configuration that whitelists the 'srcdoc' attribute on HTML 'iframe' tags. When processed and stored, browsers render the content of this attribute by decoding nested HTML entities, converting sanitized elements back into executable code.\n\n## TL;DR\nA stored cross-site scripting vulnerability in code16 Sharp allows authenticated users to inject arbitrary JavaScript via the 'srcdoc' attribute of an 'iframe' in rich-text fields. This bypasses backend sanitization because web browsers decode HTML entities within this attribute before execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (N)\n- **CVSS Score**: 7.3\n- **EPSS Score**: 0.0021\n- **EPSS Percentile**: 10.08%\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- code16/sharp\n- **sharp**: < 9.22.5 (Fixed in: `9.22.5`)\n\n## Mitigation\n\n- Upgrade code16/sharp to version 9.22.5 or higher\n- Deploy custom server-side middleware to sanitize or strip the srcdoc attribute from incoming HTML payloads\n- Configure Content Security Policy (CSP) headers to restrict frame sources and script execution context\n\n**Remediation Steps:**\n1. Open the terminal in the application root directory.\n2. Execute the command: composer update code16/sharp\n3. Verify the installed version is 9.22.5 or higher in the composer.lock file.\n4. Inspect custom rich-text configurations to ensure RAW_HTML properties are only granted to trusted administrative roles.\n\n## References\n\n- [GitHub Security Advisory GHSA-qxg3-46rw-79j8](https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8)\n- [NVD CVE-2026-61823 Reference Record](https://nvd.nist.gov/vuln/detail/CVE-2026-61823)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61823) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T18:30:32.000000Z"}, {"uuid": "2861c535-e3ec-42c8-a92c-61ffe30af2a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61825", "type": "seen", "source": "https://gist.github.com/alon710/81ebeb26ef49d3bdcb489d52174596c0", "content": "# CVE-2026-61825: CVE-2026-61825: Stored Cross-Site Scripting (XSS) via data-html-content Sanitizer Bypass in code16/sharp\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61825\n\n## Summary\nCVE-2026-61825 is a high-severity, stored Cross-Site Scripting (XSS) vulnerability identified in code16/sharp, a Laravel-based administrative framework. The flaw resides within the administrative backend's rich-text and markdown editor field formatter. By bypassing HTML sanitization via crafted elements containing the data-html-content attribute or iframe srcdoc execution parameters, lower-privileged users can inject and execute arbitrary JavaScript code.\n\n## TL;DR\nStored Cross-Site Scripting (XSS) in code16/sharp prior to 9.22.5 allows lower-privileged users to bypass HTML sanitization and execute arbitrary JavaScript via crafted elements containing 'data-html-content' or iframe 'srcdoc' attributes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.7\n- **EPSS Score**: 0.00219\n- **Impact**: High (Stored XSS / Session Hijacking / Admin Takeover)\n- **Exploit Status**: Proof-of-Concept (via Unit Tests)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- code16/sharp Laravel Administrative Framework\n- **sharp**: < 9.22.5 (Fixed in: `9.22.5`)\n\n## Mitigation\n\n- Upgrade package dependency to version 9.22.5 or higher.\n- Disable the RAW_HTML toolbar option in all SharpForm text fields.\n- Add strict backend sanitization on content input streams.\n- Deploy WAF rules to inspect and block requests carrying 'data-html-content' or 'srcdoc' attributes.\n\n**Remediation Steps:**\n1. Verify your currently installed version of code16/sharp using 'composer show code16/sharp'.\n2. Run 'composer update code16/sharp' to pull version 9.22.5 or later.\n3. Verify that the update is recorded in composer.lock and commit changes.\n4. Scan codebase for occurrences of 'SharpFormEditorField::RAW_HTML' to confirm configuration safety.\n\n## References\n\n- [GitHub Security Advisory GHSA-vj3q-vp3g-j9c8](https://github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8)\n- [Fix Commit ec509a22](https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21)\n- [CVE-2026-61825 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61825)\n- [NVD Vulnerability Details for CVE-2026-61825](https://nvd.nist.gov/vuln/detail/CVE-2026-61825)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61825) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T19:30:32.000000Z"}]}