CVE-2026-18526: HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

Severity: high (CVSS 7.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-10-27
Weakness: CWE-79

Description

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.

Affected products

humhub: 1.18.4

References

https://fluidattacks.com/advisories/greeicy
https://github.com/humhub/humhub
https://github.com/humhub/humhub/pull/8373

Get alerted when CVE-2026-18526 or the next vulnerability affects your stack