CVE-2026-93455

django-page-cms through 2.0.13 fails to properly validate page permissions in its admin helper views (specifically in pages/admin/views.py). This allows any staff account with low-privilege credentials to read arbitrary page content and stored media paths, enumerate content identifiers, and acces...

WordPress Core <= 7.1 - Admin+ Stored XSS in Custom Header Images vulnerability

Admin+ Stored XSS in Custom Header Images vulnerability discovered by Jeremy Felt in WordPress core versions = 7.1...

PT-2026-95218

Name of the Vulnerable Software and Affected Versions django-page-cms versions prior to 2.0.14 Description Five admin mutation views in pages/admin/views.py are exempt from Cross-Site Request Forgery CSRF protection. This allows attackers to forge requests that modify page content. Signed-in...

CVE-2026-87915: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

CVE-2026-93659: Improper Neutralization of Input During Web Page Generation

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93455: Missing Authorization

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93456: Cross-Site Request Forgery (CSRF)

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

PT-2026-95279

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.69 Description An Insecure Direct Object Reference IDOR exists in the duplicate function hooked on admin init. The issue occurs because the handler verifies only the generic edit posts capability and a...

PT-2026-95343

Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.24.1 Description The plugin is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. Unauthenticated attackers can inject arbitrary web scripts...

Esri Portal for ArcGIS 11.1 / 11.3 < Security 2026 Update 3 HTML Injection (CVE-2026-69237)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1 or 11.3 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - An HTML injection vulnerability exists in Esri Portal for ArcGIS that allows a remote attacker with administrative...

Linux Distros Unpatched Vulnerability : CVE-2026-90229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference...

CVE-2026-54648

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54642 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54648 CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54597

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54596

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-50022

Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An...

EUVD-2026-60601

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin...

GHSA-XHFV-7758-R9HX Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...