AVideo CVSS 10: one WebSocket message owns every viewer, no click needed
A perfect-score stored XSS in AVideo's YPTSocket hits all connected browsers instantly. Also: Flowise command injection (9.9), ElectricSQL SQL injection that gives full PostgreSQL read/write (9.9), an unauth WordPress SMTP hijack via Sendmachine (9.8), and a Firefox DOM security bypass (9.8).
Five critical bugs today, none exploited in the wild yet, but a CVSS 10 in AVideo's WebSocket plugin deserves your attention first. An unauthenticated attacker can hijack every connected browser session, including admins, with zero interaction required. Firefox also has a 9.8 DOM security bypass that could compromise browsers just by visiting a malicious page, so push that update to your fleet now.
Today's CVEs
Sorted by urgencyCVE-2026-40911
NVDAn unauthenticated attacker can send a crafted WebSocket message to AVideo's YPTSocket plugin, and the server will relay it straight to every connected browser. Two eval() calls on the client side execute the attacker's JavaScript in the context of every viewer, including admins. That means instant session theft, account takeover, and full control of the platform with zero interaction required from victims.
- Affected estate
- Anyone self-hosting AVideo (WWBN) version 29.0 or earlier with the YPTSocket plugin enabled
Evidence trail
- NVD: View source
CVE-2026-40933
NVDFlowise's "Custom MCP" feature lets any authenticated user add a stdio-based MCP server with an arbitrary command. The input sanitization checks are easy to bypass: you can pass something like 'npx -c touch /tmp/pwn' through the allow-listed 'npx' command. That gives you OS-level command execution on the Flowise host. You need a valid login, but any user role can pull it off.
- Affected estate
- Anyone running Flowise versions before 3.1.0, especially instances exposed to the internet or shared with untrusted users
Evidence trail
- NVD: View source
CVE-2026-40906
NVDThe order_by parameter in ElectricSQL's /v1/shape API doesn't sanitize input, so any authenticated user can inject SQL through crafted ORDER BY expressions. This isn't read-only: an attacker can read, write, and delete everything in your PostgreSQL database. If your Electric instance is reachable by untrusted users, your entire database is exposed.
- Affected estate
- Anyone running ElectricSQL (Electric) versions 1.1.12 through 1.4.x with the /v1/shape API exposed
Evidence trail
- NVD: View source
CVE-2026-6235
NVDThe Sendmachine for WordPress plugin doesn't check whether the caller is actually authorized when handling admin requests. An unauthenticated attacker can overwrite your SMTP configuration, rerouting all outbound email through a server they control. That includes password reset emails, which means full site takeover is one "forgot password" click away.
- Affected estate
- WordPress site owners running the Sendmachine plugin version 1.0.20 or earlier
Evidence trail
- NVD: View source
CVE-2026-6771
NVDA bypass in Firefox's DOM Security component lets attackers get around protections that are supposed to prevent malicious page content from executing privileged actions. Mozilla's description is sparse, but a CVSS 9.8 on a DOM security mitigation bypass typically means a crafted webpage could compromise your browser without much user interaction beyond visiting the page.
- Affected estate
- Anyone running Firefox before 150, Firefox ESR before 140.10, Thunderbird before 150, or Thunderbird ESR before 140.10
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom the field notes
From this beat
Read the rest of the field notes →