CVE-2026-18526: Humhub

High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days.

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.

Affected products

• Humhub Humhub: version 1.18.4 only

Published 2026-08-19. Last modified 2026-08-28.