{"vulnerability": "cve-2026-8499", "sightings": [{"uuid": "1d133213-9e25-457d-8a5b-44b0b3b34eea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8499", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnto3pp7i72m", "content": "CVE-2026-8499 - Helpfulcrowd Product Reviews\nCVE ID : CVE-2026-8499\n \n Published : June 9, 2026, 5:16 a.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up...", "creation_timestamp": "2026-06-09T07:24:10.547274Z"}, {"uuid": "4bd5bb57-1870-431b-8b8a-74bc438b051e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8499", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mnzjfhayk42t", "content": "CVE-2026-8499 helpfulcrowd-product-reviews (CVSS Score 5.3) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept #helpfulcrowd-product-reviews", "creation_timestamp": "2026-06-11T15:16:16.413229Z"}, {"uuid": "0640b5fc-c9e9-47a5-ba68-d049450ebfd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84997", "type": "published-proof-of-concept", "source": "https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54", "content": "", "creation_timestamp": "2026-09-17T22:35:15.116896Z"}, {"uuid": "260ce21c-fbb9-4540-b6d0-df2f7159f631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84997", "type": "seen", "source": "https://gist.github.com/alon710/5bae97c112644e43c69dc3ea5005f105", "content": "# CVE-2026-84997: CVE-2026-84997: Infinite Loop Denial of Service in ReactPHP HTTP Component\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84997\n\n## Summary\nAn infinite loop vulnerability in ReactPHP's react/http chunked transfer encoding decoder (v0.6.0 up to 1.11.1) allows unauthenticated remote attackers to trigger a denial of service (DoS) by sending crafted chunked requests or responses, completely freezing the single-threaded event loop and pegging CPU usage to 100%.\n\n## TL;DR\nA logical flaw in ReactPHP's chunked parser allows remote attackers to block the single-threaded event loop indefinitely using malformed chunked transfer encoding payloads, leading to a complete Denial of Service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: PoC available in test suite\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU exhaustion and event-loop freeze)\n\n## Affected Systems\n\n- ReactPHP HTTP Server (react/http)\n- ReactPHP HTTP Browser (react/http client)\n- Any server-side PHP framework or server layer that utilizes ReactPHP's stream handlers for Transfer-Encoding processing.\n- **react/http**: >= 0.6.0, < 1.11.1 (Fixed in: `1.11.1`)\n\n## Mitigation\n\n- Upgrade react/http package dependencies to 1.11.1 or newer.\n- Deploy upstream reverse proxies (Nginx, HAProxy) to normalize and validate HTTP request chunk boundaries before forwarding to ReactPHP.\n- Configure strict connection timeouts to enforce active stream termination.\n\n**Remediation Steps:**\n1. In the ReactPHP application directory, run 'composer require react/http:^1.11.1' to update the package dependency.\n2. Confirm the lockfile registers version 1.11.1 or greater.\n3. Deploy and configure an upstream reverse proxy like Nginx with standard request normalization enabled.\n4. Verify server operation using the non-disruptive integration test suites.\n\n## References\n\n- [GitHub Security Advisory (GHSA-x424-64qh-5j54)](https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54)\n- [Core Parser Logic Fix Commit](https://github.com/reactphp/http/commit/b6d4688790adf3797071fcf88a3fc4225f30486a)\n- [Trailer Size Limit Commit](https://github.com/reactphp/http/commit/58bc906dcaa5d360830555360bfdeacff3be0260)\n- [Integration Merge Commit](https://github.com/reactphp/http/commit/c0865b4687da67bf01c59074a8896a93565f82bd)\n- [Release v1.11.1 Release Notes](https://github.com/reactphp/http/releases/tag/v1.11.1)\n- [Release Tag Commit](https://github.com/reactphp/http/commit/e5b8eb2654dec6cbbc692a39f05ea4ecd40c8cc1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84997) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T08:31:51.857853Z"}, {"uuid": "29d751a2-127c-40a6-9beb-917d6d2e7742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84992", "type": "published-proof-of-concept", "source": "https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6", "content": "", "creation_timestamp": "2026-09-18T18:35:10.009077Z"}, {"uuid": "18ea1735-6c46-417c-9a65-726847e0478d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84992", "type": "seen", "source": "https://gist.github.com/alon710/bea1abe85bdbc7360f709e8ba11f8e2a", "content": "# CVE-2026-84992: CVE-2026-84992: Cross-Site Scripting (XSS) via Fenced Code Block Parsing in md-editor-v3\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84992\n\n## Summary\nCVE-2026-84992 is a Cross-Site Scripting (XSS) vulnerability affecting md-editor-v3 before version 6.5.4. It occurs because the fenced-code block language parser directly interpolates unescaped language metadata into unquoted HTML attributes inside the custom rendering callback. This bypasses the built-in XSSPlugin which runs during the parsing phase, before rendering.\n\n## TL;DR\nA Cross-Site Scripting (XSS) vulnerability exists in md-editor-v3 prior to version 6.5.4, allowing unauthenticated remote execution of client-side scripts via crafted Markdown containing malicious fenced-code headers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.1 (Medium)\n- **Exploit Status**: PoC / Theoretical\n- **KEV Status**: Not Listed\n- **Impact**: Client-side Script Execution / Session Hijacking\n\n## Affected Systems\n\n- md-editor-v3 package for Vue 3\n- Applications rendering untrusted Markdown using MdPreview or MdEditor in md-editor-v3\n- **md-editor-v3**: < 6.5.4 (Fixed in: `6.5.4`)\n\n## Mitigation\n\n- Upgrade to md-editor-v3 version 6.5.4 or later.\n- Implement a robust Content Security Policy (CSP) blocking inline scripts ('unsafe-inline').\n- Apply post-rendering sanitization using DOMPurify on client-rendered HTML output.\n\n**Remediation Steps:**\n1. Open your project directory and inspect package.json for 'md-editor-v3'.\n2. Execute the upgrade command: `npm install md-editor-v3@6.5.4` or `yarn upgrade md-editor-v3@6.5.4`.\n3. Verify the installed version in your lockfile to ensure no vulnerable dependencies remain.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [NVD Record for CVE-2026-84992](https://nvd.nist.gov/vuln/detail/CVE-2026-84992)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-84992)\n- [GitHub Security Advisory GHSA-3rm2-h79c-8qw6](https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6)\n- [Patch Commit](https://github.com/imzbf/md-editor-v3/commit/2c07360420e74087f5bc63032ab155d93e0a0b10)\n- [Release v6.5.4 Changelog](https://github.com/imzbf/md-editor-v3/releases/tag/v6.5.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84992) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T11:31:49.543770Z"}]}