CVE-2026-126814

blueprintUE Self-Hosted Edition versions before 4.3.6 are vulnerable to an iframe injection vulnerability. The root cause lies in the PeerTube video URL matcher within the BlueprintService::findVideoProvider() function. An authenticated user can provide a video URL pointing to an attacker-control...

EUVD-2026-124029

blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider. Attackers can set a blueprint video URL on an...