What is CVE-2026-67595?

CVE-2026-67595 is a high-severity vulnerability in Webreinvent Vaahcms, classified under CWE-506. CVSS score: 8.1/10. Published 2026-07-29.

How severe is CVE-2026-67595?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Webreinvent Vaahcms

CVE-2026-67595

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that…

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Webreinvent Vaahcms — versions 2.0.0, 8d7898f7a385a5fade1180a9b664ff158d873129

Weakness classification (CWE)

CWE-506

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-67595?: CVE-2026-67595 is a high-severity vulnerability in Webreinvent Vaahcms, classified under CWE-506. CVSS score: 8.1/10. Published 2026-07-29.
How severe is CVE-2026-67595?: High severity. CVSS v3 base score is 8.1 out of 10.