🕵️ RESEARCH & DEEP DIVES
Hugo before v0.165.0: TailwindCSS default allow list enables build sandbox bypass (CVE-2026-89259)
Hugo before v0.165.0 allowed a Node tool invoked during builds to bypass permission restrictions and read/write files outside the project directory.- Affects Hugo versions after v0.43 up to (but not including) v0.165.0; users who don't use TailwindCSS or only build trusted sites are unaffected.
- TailwindCSS was in Hugo's default security.exec.allow list but requires highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), undermining the fix for GHSA-x597-9fr4-5857.
- A malicious Node tool executed during a build could therefore read and write files outside the project's working directory.
- Fixed in v0.165.0 by removing tailwindcss from the default security.exec.allow list.
- Rated critical: CVSS 3.1 score 9.8; reported by mtholmquist and assigned CVE-2026-89259.
AVideo through 29.0 IDOR lets non-admin users delete any category's assets (CVE-2026-89257)
AVideo through 29.0 has an IDOR vulnerability allowing authenticated non-admin users to delete any category's on-disk asset files.- Affects AVideo through version 29.0; tracked as CVE-2026-89257 (CVSS 5.3), reported by manus-use and assigned by VulnCheck.
- The objects/categoryDeleteAssets.json.php endpoint checks only canCreateCategory capability and a CSRF nonce, skipping the userCanEditCategory ownership check.
- When the non-default usersCanCreateNewCategories setting is enabled, a non-admin user with canUpload can POST an arbitrary category ID and recursively delete that category's icons/images asset directory.
- Category records and videos are not deleted; no patched version was available at publication.
AVideo LoginControl plugin has stored XSS via unencoded PGP public keys (CVE-2026-89255)
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored XSS vulnerability in its LoginControl plugin.- Applies to AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1, affecting the LoginControl plugin.
- PGP public keys are echoed into a textarea element without HTML encoding, allowing injection of malicious JavaScript.
- An authenticated attacker submits a crafted public key, which executes in an administrator's session when viewing the user's profile tab.
- Rated 9.3 Critical (CVSS 4.0) and 8.7 High (CVSS 3.1); tracked as CVE-2026-89255, reported by santhreal.
AVideo CustomizeUser plugin stored XSS via field_name parameter (CVE-2026-89254, CVSS 9.3)
AVideo contains a stored cross-site scripting vulnerability in its CustomizeUser plugin's field_name parameter.- Applies to AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (CVE-2026-89254, scored 9.3 CVSS 4.0 / 8.7 CVSS 3.1).
- The CustomizeUser plugin stores the field_name parameter raw without sanitization, allowing script injection.
- Authenticated administrators can inject malicious scripts via the add.json.php endpoint.
- Injected scripts execute when viewing extra info pages or profile forms that render the typeToHTML function.
- Reported by santhreal; classified as CWE-79 cross-site scripting.
🕵️ RESEARCH & DEEP DIVES
GitLab urges users to patch max severity path traversal flaw — BleepingComputer
Check Point Patches Critical VPN Vulnerabilities — SecurityWeek
Kiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance — SecurityWeek
Cliff Stoll’s DEF CON Talk — Schneier on Security
CVE-2026-86793SGLang allows unauthenticated pickle deserialization through /u... — CVE ThreatInt
BuddyPress through 14.3.3 - Insecure Direct Object Reference to Notifications Dele... — CVE ThreatInt
compression vulnerable to Denial of Service via memory leak on premature resp... — CVE ThreatInt
Hugo before v0.165.0 Symlink Confinement Bypass via resources.GetHugo is a st... — CVE ThreatInt
AVideo Bookmark Plugin Stored XSS via Chapter NamesAVideo through commit c3ed... — CVE ThreatInt
AVideo Stored XSS via donationLink in watch page buttonWWBN AVideo through co... — CVE ThreatInt
AVideo Missing Authorization in addLiveLink.php LiveLink UpdateAVideo through... — CVE ThreatInt
AVideo Missing Authorization via AD_Server log.php Wallet CreditAVideo throug... — CVE ThreatInt
WWBN AVideo Unauthenticated File Read via getRecordedFile.phpWWBN AVideo thro... — CVE ThreatInt
AVideo YPTWallet Stored XSS via CryptoWallet ConfigurationAVideo through comm... — CVE ThreatInt
AVideo WebRTC Plugin Information Disclosure via status.json.phpAVideo through... — CVE ThreatInt
WWBN AVideo XML Injection via plugin/AD_Server/VMAP.phpWWBN AVideo at commit ... — CVE ThreatInt
WWBN AVideo CSV Formula Injection via myComments.download.phpWWBN AVideo thro... — CVE ThreatInt
WWBN AVideo Cross-Site Request Forgery via playlistRemove.phpWWBN AVideo thro... — CVE ThreatInt
WWBN AVideo Reflected XSS via Gallery Category getBackURLWWBN AVideo through ... — CVE ThreatInt
WWBN AVideo Stored XSS via UserGroups setGroup_nameWWBN AVideo through commit... — CVE ThreatInt
Conti Ransomware Hacker Sentenced After Group Attacked Over 1,000 Victims Worldwide — Cyber Security News
New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims — Cyber Security News
Ubuntu 24.04.5 LTS Released With Linux 7.0 Kernel and Latest Security Updates — Cyber Security News
cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands — Cyber Security News
Launching managed CRA Article 14 reporting for open source maintainers — patchstack.com (discovered)
How Do You Test an AI Product When the Same Input Can Produce Different Answers? — securityboulevard.com (discovered)
Can You Fail a Pentest? What SaaS Startups Should Know — securityboulevard.com (discovered)
What an external penetration test is and how one is actually run — <https://securityboulevard.com/202