https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 26 Sep 2026 06:40:17 +0000 https://vulnerability.circl.lu/sighting/2fa6c032-93c4-4285-9213-07c73a73133b/export {"uuid": "2fa6c032-93c4-4285-9213-07c73a73133b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57440", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mweflk3cms2w", "content": "CVE-2026-57440 affects MediaWiki EmbedVideo when $wgEmbedVideoRequireConsent is disabled: a malformed video URL can escape the iframe src and inject HTML or JavaScript. #software", "creation_timestamp": "2026-09-25T18:28:47.285614Z"} {"uuid": "2fa6c032-93c4-4285-9213-07c73a73133b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57440", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mweflk3cms2w", "content": "CVE-2026-57440 affects MediaWiki EmbedVideo when $wgEmbedVideoRequireConsent is disabled: a malformed video URL can escape the iframe src and inject HTML or JavaScript. #software", "creation_timestamp": "2026-09-25T18:28:47.285614Z"} https://vulnerability.circl.lu/sighting/2fa6c032-93c4-4285-9213-07c73a73133b/export Fri, 25 Sep 2026 18:28:47 +0000 https://vulnerability.circl.lu/sighting/45fa11c6-0084-4def-93c2-8a674c81c538/export {"uuid": "45fa11c6-0084-4def-93c2-8a674c81c538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57440", "type": "seen", "source": "https://gist.github.com/alon710/43cc054a1c1ef89b52a71a555d759fdb", "content": "# CVE-2026-57440: CVE-2026-57440: Stored Cross-Site Scripting (XSS) in MediaWiki EmbedVideo Extension\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57440\n\n## Summary\nCVE-2026-57440 is a high-severity stored Cross-Site Scripting (XSS) vulnerability affecting the EmbedVideo extension for MediaWiki. When the extension is configured with consent requirements disabled ($wgEmbedVideoRequireConsent = false), video URLs and service IDs are parsed and inserted directly into the 'src' attribute of a generated iframe element without sanitization or context-aware escaping. This allows an attacker with editing privileges to inject arbitrary JavaScript and execute malicious commands in the context of other users' sessions.\n\n## TL;DR\nStored Cross-Site Scripting (XSS) in the MediaWiki EmbedVideo extension before version 4.1.0 allows authenticated or anonymous page editors to execute arbitrary JavaScript in the browsers of wiki visitors when video consent overlays are disabled.\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (Remote)\n- **CVSS Severity**: 7.5 (High)\n- **EPSS Score**: 0.00255 (Percentile: 15.21%)\n- **Exploit Status**: None / Unproven\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No Known Involvement\n\n## Affected Systems\n\n- mediawiki-extensions-EmbedVideo\n- **mediawiki-extensions-EmbedVideo**: < 4.1.0 (Fixed in: `4.1.0`)\n\n## Mitigation\n\n- Upgrade EmbedVideo extension to version 4.1.0 or newer.\n- Enable consent requirements in MediaWiki configuration ($wgEmbedVideoRequireConsent = true).\n- Deploy a restrictive Content Security Policy (CSP) that blocks inline script execution ('unsafe-inline').\n\n**Remediation Steps:**\n1. Verify the installed version of EmbedVideo by checking 'extensions/EmbedVideo/extension.json'.\n2. If the version is prior to 4.1.0, pull the latest stable version or apply the official patch.\n3. Alternatively, modify 'LocalSettings.php' to set '$wgEmbedVideoRequireConsent = true;' as an immediate mitigation.\n4. Restrict editing permissions on public wiki namespaces to trusted or autoconfirmed accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-v65j-hff3-753c](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c)\n- [Official Security Fix Commit](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84)\n- [Official CVE Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-57440)\n- [NVD Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-57440)\n- [Repository Home Page](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo)\n- [JSON Definition (CvelistV5)](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57440.json)\n- [Secondary Contextual Commit (Archive.org Slash Fix)](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/a573a16d925ee0ea0d34b360856dc8ab0b88f822)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57440) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T17:30:28.000000Z"} {"uuid": "45fa11c6-0084-4def-93c2-8a674c81c538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57440", "type": "seen", "source": "https://gist.github.com/alon710/43cc054a1c1ef89b52a71a555d759fdb", "content": "# CVE-2026-57440: CVE-2026-57440: Stored Cross-Site Scripting (XSS) in MediaWiki EmbedVideo Extension\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57440\n\n## Summary\nCVE-2026-57440 is a high-severity stored Cross-Site Scripting (XSS) vulnerability affecting the EmbedVideo extension for MediaWiki. When the extension is configured with consent requirements disabled ($wgEmbedVideoRequireConsent = false), video URLs and service IDs are parsed and inserted directly into the 'src' attribute of a generated iframe element without sanitization or context-aware escaping. This allows an attacker with editing privileges to inject arbitrary JavaScript and execute malicious commands in the context of other users' sessions.\n\n## TL;DR\nStored Cross-Site Scripting (XSS) in the MediaWiki EmbedVideo extension before version 4.1.0 allows authenticated or anonymous page editors to execute arbitrary JavaScript in the browsers of wiki visitors when video consent overlays are disabled.\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (Remote)\n- **CVSS Severity**: 7.5 (High)\n- **EPSS Score**: 0.00255 (Percentile: 15.21%)\n- **Exploit Status**: None / Unproven\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No Known Involvement\n\n## Affected Systems\n\n- mediawiki-extensions-EmbedVideo\n- **mediawiki-extensions-EmbedVideo**: < 4.1.0 (Fixed in: `4.1.0`)\n\n## Mitigation\n\n- Upgrade EmbedVideo extension to version 4.1.0 or newer.\n- Enable consent requirements in MediaWiki configuration ($wgEmbedVideoRequireConsent = true).\n- Deploy a restrictive Content Security Policy (CSP) that blocks inline script execution ('unsafe-inline').\n\n**Remediation Steps:**\n1. Verify the installed version of EmbedVideo by checking 'extensions/EmbedVideo/extension.json'.\n2. If the version is prior to 4.1.0, pull the latest stable version or apply the official patch.\n3. Alternatively, modify 'LocalSettings.php' to set '$wgEmbedVideoRequireConsent = true;' as an immediate mitigation.\n4. Restrict editing permissions on public wiki namespaces to trusted or autoconfirmed accounts.\n\n## References\n\n- [GitHub Security Advisory GHSA-v65j-hff3-753c](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c)\n- [Official Security Fix Commit](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84)\n- [Official CVE Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-57440)\n- [NVD Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-57440)\n- [Repository Home Page](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo)\n- [JSON Definition (CvelistV5)](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57440.json)\n- [Secondary Contextual Commit (Archive.org Slash Fix)](https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/a573a16d925ee0ea0d34b360856dc8ab0b88f822)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57440) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T17:30:28.000000Z"} https://vulnerability.circl.lu/sighting/45fa11c6-0084-4def-93c2-8a674c81c538/export Fri, 25 Sep 2026 17:30:28 +0000 https://vulnerability.circl.lu/sighting/466fff32-445e-4ef8-ae46-17bd2195a6b7/export {"uuid": "466fff32-445e-4ef8-ae46-17bd2195a6b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57440", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwd4prf4i32c", "content": "\ud83d\udfe0 CVE-2026-57440 - High (7.5)\n\nThe EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and var...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-57440/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T06:17:25.854684Z"} {"uuid": "466fff32-445e-4ef8-ae46-17bd2195a6b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57440", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwd4prf4i32c", "content": "\ud83d\udfe0 CVE-2026-57440 - High (7.5)\n\nThe EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and var...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-57440/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T06:17:25.854684Z"} https://vulnerability.circl.lu/sighting/466fff32-445e-4ef8-ae46-17bd2195a6b7/export Fri, 25 Sep 2026 06:17:25 +0000 https://vulnerability.circl.lu/sighting/c58467f2-174a-4176-8440-d3fedb68319e/export {"uuid": "c58467f2-174a-4176-8440-d3fedb68319e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57440", "type": "published-proof-of-concept", "source": "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c", "content": "", "creation_timestamp": "2026-06-24T18:57:23.000000Z"} {"uuid": "c58467f2-174a-4176-8440-d3fedb68319e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-57440", "type": "published-proof-of-concept", "source": "https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c", "content": "", "creation_timestamp": "2026-06-24T18:57:23.000000Z"} https://vulnerability.circl.lu/sighting/c58467f2-174a-4176-8440-d3fedb68319e/export Wed, 24 Jun 2026 18:57:23 +0000