{"vulnerability": "CVE-2026-8925", "sightings": [{"uuid": "bd0e1695-e405-4488-b4c7-a10d331ad553", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8925", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpriyry2yp2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-8925 \u0432 curl: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 SASL-\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438\n\n\n\nhttps://kripta.biz/posts/C9DC25BA-9064-4E32-9900-9A1AD029166C", "creation_timestamp": "2026-07-03T21:38:07.448519Z"}, {"uuid": "ee98e09a-0653-434c-ac1d-02a41cba1f31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8925", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mqp5wvyuvz2h", "content": "Patch 1.29.5-asm.12 contains fixes for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-46595 Yes Yes Yes Yes Critical (10.0) CVE-2026-8376 Yes Yes No Yes Medium (9.8) CVE-2026-8925 Yes Yes No Yes Medium (9.8) CVE-2026-39830 Yes Yes Yes", "creation_timestamp": "2026-07-15T16:40:07.717881Z"}, {"uuid": "1e7da960-fe84-4670-a4c6-7a64e2e07acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89259", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117252294469654613", "content": "CVE-2026-89259 (CRITICAL): gohugoio Hugo <0.165.0 lets Node tools like TailwindCSS bypass security.exec.allow list, enabling file access outside project dirs. Upgrade to 0.165.0 or restrict exec.allow in hugo.toml. https://radar.offseq.com/threat/cve-2026-89259-execution-with-unnecessary-privileges-in-gohugoio-hugo-3319ecf718eb9ea0 #OffSeq #CVE #Hugo #InfoSec", "creation_timestamp": "2026-09-11T12:00:29.287101Z"}, {"uuid": "90a79359-15a1-4fe7-b529-152d7c19c660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89259", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvajeetqqz2f", "content": "Hugo static site generator (<0.165.0) hit by CRITICAL CVE-2026-89259: Node tools can access files outside project dirs. Upgrade to 0.165.0 or restrict exec.allow in hugo.toml. https://radar.offseq.com/threat/cve-2026-89259-execution-with-unnecessary-privileges-in-gohugoio-hugo-3319ecf718eb9ea0 #O...", "creation_timestamp": "2026-09-11T12:00:31.401368Z"}, {"uuid": "f0413fbe-1e36-4511-8012-ef048451b210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89259", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvakzbbksa2t", "content": "CVE-2026-89259 - hugo\nVersions of Hugo from 0.43 up to 0.164 let the TailwindCSS tool run with very loose permissions, so a script called during site building could access files outside the project folder.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hugo #gohugoio #CVE #infosec", "creation_timestamp": "2026-09-11T12:30:06.199756Z"}, {"uuid": "e0949674-06fa-4969-89d2-f6edf7a82ff6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89255", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7g4dbmxt5n55w", "content": "CVE-2026-89255 - AVideo LoginControl Stored XSS via PGP Public Key\nCVE ID : CVE-2026-89255\n \n Published : Sept. 11, 2026, 12:16 p.m. | 39\u00a0minutes ago\n \n Description : AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerab...", "creation_timestamp": "2026-09-11T13:04:58.191489Z"}, {"uuid": "6db2fdae-992f-4128-9ff3-3fb05585a7d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89259", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2bi4izqn76w5f", "content": "CVE-2026-89259 - Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS\nCVE ID : CVE-2026-89259\n \n Published : Sept. 11, 2026, 12:16 p.m. | 39\u00a0minutes ago\n \n Description : Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's p...", "creation_timestamp": "2026-09-11T13:10:57.834207Z"}, {"uuid": "6b20f1d7-0f63-4849-9789-e060e422de25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89258", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5wdd4gt7muuyn", "content": "CVE-2026-89258 - Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get\nCVE ID : CVE-2026-89258\n \n Published : Sept. 11, 2026, 12:16 p.m. | 39\u00a0minutes ago\n \n Description : Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in p...", "creation_timestamp": "2026-09-11T13:17:06.300524Z"}, {"uuid": "cd7e2ecc-1a84-482a-968a-e02706016250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89253", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvanst2rds2j", "content": "CVE-2026-89253 - avideo\nAVideo saves the web address that users enter for a donation button without fully checking it. An attacker can craft a special address that injects code into the video page, so anyone who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-11T13:20:17.694392Z"}, {"uuid": "8df4a4c3-afa1-4ac6-9391-54d0fa2827e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89256", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2hwso7fhid74v", "content": "CVE-2026-89256 - AVideo Bookmark Plugin Stored XSS via Chapter Names\nCVE ID : CVE-2026-89256\n \n Published : Sept. 11, 2026, 12:16 p.m. | 39\u00a0minutes ago\n \n Description : AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulner...", "creation_timestamp": "2026-09-11T13:23:03.892992Z"}, {"uuid": "8f218877-b72e-4368-baa0-f0f807d7c2ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89258", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvaoejw7io25", "content": "CVE-2026-89258 - hugo\nVersions of Hugo from 0.123.0 up to 0.164.x can follow symbolic links placed in a theme folder and read files that are outside the website\u2019s directory. This can let an attacker or a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hugo #gohugoio #CVE #infosec", "creation_timestamp": "2026-09-11T13:30:05.090715Z"}, {"uuid": "6cff20de-470b-462d-8f86-dba2cfc528ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89254", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvaowkodiq2f", "content": "CVE-2026-89254 - avideo\nThe AVideo system\u2019s CustomizeUser feature stores a field value exactly as entered. Because the value isn\u2019t cleaned, an administrator can place harmful code that runs whenever a user opens\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-11T13:40:11.710834Z"}, {"uuid": "96c01530-99ce-431f-8321-e9a89c6b0c56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89255", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvapiem6xi24", "content": "CVE-2026-89255 - avideo\nThe AVideo platform's LoginControl feature does not properly clean up PGP public keys that are displayed, allowing a logged\u2011in user to insert malicious code. When an administrator looks\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-11T13:50:07.409389Z"}, {"uuid": "ecfeb453-ac2f-49ea-9213-1bbca5c748af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89256", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvapiglkmd2j", "content": "CVE-2026-89256 - avideo\nIn AVideo, the Bookmark feature does not clean the chapter name before showing it on the video page. This lets a video owner insert malicious code that runs in the browsers of anyone who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#avideo #wwbn #CVE #infosec", "creation_timestamp": "2026-09-11T13:50:08.983985Z"}, {"uuid": "4ab75837-ff9c-4563-98d1-1f3c49645eea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89256", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvaqiavt2n2g", "content": "\ud83d\udea8 CVE-2026-89256 \u2014 CVSS 9.3 CRITICAL\n\nAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulne...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89256\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T14:07:56.651356Z"}, {"uuid": "1cd56ec7-01c3-4417-92eb-76e90debb107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89253", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvaqhgzf662f", "content": "\ud83d\udea8 CVE-2026-89253 \u2014 CVSS 9.3 CRITICAL\n\nWWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89253\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T14:07:29.592625Z"}, {"uuid": "3db2d074-1a1d-4382-be35-4af48494005f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89254", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvaqhppjbb25", "content": "\ud83d\udea8 CVE-2026-89254 \u2014 CVSS 9.3 CRITICAL\n\nAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulne...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89254\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T14:07:38.817059Z"}, {"uuid": "5826df11-21d5-43e2-9ed5-0b6552be0564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89255", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvaqhxzomc2j", "content": "\ud83d\udea8 CVE-2026-89255 \u2014 CVSS 9.3 CRITICAL\n\nAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulne...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89255\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T14:07:47.478156Z"}, {"uuid": "338cb613-3722-48fc-add7-a9eb0d98748c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89258", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvaqijlj3w2j", "content": "\ud83d\udea8 CVE-2026-89258 \u2014 CVSS 9.3 CRITICAL\n\nHugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89258\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T14:08:06.999085Z"}, {"uuid": "24cb35dd-87ce-45f0-9abc-16b33b68a6fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89259", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvaqitmvkb2p", "content": "\ud83d\udea8 CVE-2026-89259 \u2014 CVSS 9.3 CRITICAL\n\nHugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89259\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-11T14:08:23.459916Z"}]}