{"vulnerability": "cve-2026-8897", "sightings": [{"uuid": "24a9e429-8262-44b0-8283-a87c2f6f715f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88975", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvljgt7w5m2s", "content": "\ud83d\udfe0 CVE-2026-88975 - High (7.5)\n\nHttp4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember\u2019s HTTP/2 r...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-88975/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T21:01:11.042290Z"}, {"uuid": "bc9126c3-fbd2-4a18-82c1-61a018398fae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88976", "type": "seen", "source": "https://gist.github.com/alon710/597e5b2d04a8f95b06b03a350d6e8b1e", "content": "# CVE-2026-88976: CVE-2026-88976: HTML Deserialization Cross-Site Scripting in @platejs/core\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88976\n\n## Summary\nPlate core HTML deserialization APIs parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML to these APIs, certain HTML attributes can trigger browser behavior before the HTML is converted into editor nodes.\n\n## TL;DR\nA flaw in the HTML deserialization routines of @platejs/core prior to 53.3.11 allowed remote attackers to execute arbitrary client-side scripts via unauthenticated user interaction with crafted HTML payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.1 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @platejs/core\n- **@platejs/core**: < 53.3.11 (Fixed in: `53.3.11`)\n- **@platejs/core**: >= 54.0.0-beta.0 <= 54.0.0-beta.1 (Fixed in: `53.3.11`)\n\n## Mitigation\n\n- Upgrade @platejs/core to version 53.3.11 or above.\n- Apply secondary server-side and client-side sanitization using DOMPurify.\n- Implement a strong Content Security Policy (CSP) to restrict inline script execution.\n\n**Remediation Steps:**\n1. Identify all deployments of udecode/plate in package.json files.\n2. Run 'npm install @platejs/core@53.3.11' or equivalent package manager commands to upgrade the dependencies.\n3. Verify that DOMParser is successfully utilized in built client bundles for HTML deserialization.\n4. Sanitize all rich text data parsed or exported from the editor using a secure library.\n\n## References\n\n- [GitHub Security Advisory (GHSA-qrfj-mgw8-j9c6)](https://github.com/udecode/plate/security/advisories/GHSA-qrfj-mgw8-j9c6)\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-88976)\n- [CVE Org Record](https://www.cve.org/CVERecord?id=CVE-2026-88976)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88976) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T07:31:06.461513Z"}, {"uuid": "2a1e6b85-7cec-4ae3-a950-aa9e725265c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88978", "type": "seen", "source": "https://gist.github.com/alon710/7fc7905eeee7b3e580e11b9e78f8548b", "content": "# CVE-2026-88978: CVE-2026-88978: Multi-Tenant Isolation Failure in Hatchet Durable Workflow Engine\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88978\n\n## Summary\nCVE-2026-88978 is a critical cross-tenant data exposure vulnerability in Hatchet, a platform for orchestrating background tasks and durable workflows. The flaw exists in the durable-task event retrieval system where client-supplied task, node, and branch UUIDs are resolved via the ListSatisfiedEntries database query without verifying the tenant ownership of the requesting worker context.\n\n## TL;DR\nHatchet fails to restrict durable event log queries to the caller's tenant ID, allowing authenticated workers to view task metadata from other tenants if the target task UUID is known.\n\n## Technical Details\n\n- **CWE ID**: CWE-639 / CWE-863\n- **Attack Vector**: Network (gRPC)\n- **CVSS Score**: 4.3 (Medium)\n- **Exploit Status**: None (No public exploit available)\n- **KEV Status**: Not Listed\n- **Impact**: Cross-tenant data exposure\n\n## Affected Systems\n\n- Hatchet Control Plane\n- Hatchet Durable Event Logging System\n\n## Mitigation\n\n- Upgrade Hatchet control plane and worker engines to version 0.106.1 or later.\n- Enforce context-bound tenant filters at the database engine level for all shared tables.\n- Restrict the output of workflow UUIDs in application logs, external error reports, and client-facing telemetry.\n\n**Remediation Steps:**\n1. Identify all active control plane instances within the multi-tenant deployment.\n2. Pull the official release tag v0.106.1 or higher from the repository.\n3. Run database migrations to ensure the updated PostgreSQL query layouts are applied.\n4. Verify that gRPC services are restarted and validating the updated client schemas.\n\n## References\n\n- [GitHub Security Advisory GHSA-992g-9cr3-vm5x](https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x)\n- [Fix Commit 15bc792](https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85)\n- [CVE-2026-88978 Record](https://www.cve.org/CVERecord?id=CVE-2026-88978)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88978) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T00:32:28.110152Z"}, {"uuid": "fd5ba2e0-a35f-47be-a7a6-42f9a6af047b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88974", "type": "seen", "source": "https://gist.github.com/alon710/39d3465701d68ededce1355dd7bcc16e", "content": "# CVE-2026-88974: CVE-2026-88974: Incorrect Authorization in WPGraphQL updatePost Mutation\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88974\n\n## Summary\nCVE-2026-88974 is an incorrect authorization vulnerability in the WPGraphQL plugin for WordPress. Due to a failure to perform object-level capability checks or validate status-transition requirements in the updatePost mutation handler, authenticated Contributor-level users can publish their own draft posts without editorial approval or modify their previously published posts.\n\n## TL;DR\nAn authorization vulnerability in WPGraphQL prior to 2.22.2 allows authenticated WordPress Contributors to bypass workflow restrictions and publish drafts or modify published posts without editorial oversight.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.4\n- **Exploit Status**: PoC via test suite\n- **Impact**: Privilege Escalation / Unauthorized Publication\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- WordPress installations with WPGraphQL plugin prior to 2.22.2\n- **wp-graphql**: >= 2.19.0, < 2.22.2 (Fixed in: `2.22.2`)\n\n## Mitigation\n\n- Upgrade the WPGraphQL plugin to version 2.22.2 or higher.\n- Temporarily downgrade Contributor accounts to the Subscriber role to block access to post mutations.\n- Implement Web Application Firewall (WAF) rule sets to detect and block unauthorized post status updates.\n\n**Remediation Steps:**\n1. Access the WordPress administrative dashboard.\n2. Navigate to the Plugins menu and locate WPGraphQL.\n3. Click 'Update Now' to apply the patch for version 2.22.2.\n4. Alternatively, execute 'wp plugin update wp-graphql' using the WordPress CLI.\n5. Review user privilege assignments and audit existing posts for unauthorized changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-5mmc-8pc9-wggg](https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg)\n- [WPGraphQL Pull Request 4270](https://github.com/wp-graphql/wp-graphql/pull/4270)\n- [Vulnerability Fix Commit](https://github.com/wp-graphql/wp-graphql/commit/55441663eaa33c3f2e05de038c8286c845916461)\n- [WPGraphQL 2.22.2 Release](https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.22.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88974) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T16:32:05.554728Z"}]}