CVE-2026-126800

HighCVSS 8.7/10Last modified Nov 11, 2026

Description

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1268018.8Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAut CVE-2026-1268028.2NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unau CVE-2026-1268037.2Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or CVE-2026-1268048.1WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated use CVE-2026-1268057.2WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_has CVE-2026-1268068.7WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDo CVE-2026-1268074.3WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users CVE-2026-1268084.3weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own CVE-2026-1268097.1WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other u CVE-2026-126818.9Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does no CVE-2026-1268105.4WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through CVE-2026-1268115.4BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublishe