46240 matches found
EUVD-2026-67837
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...
CVE-2026-77939
Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...
SUSE CVE-2026-63072
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...
Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime
Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime. These vulnerabilities are addressed. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut...
CVE-2026-78032
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...
EUVD-2026-67579
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...
CVE-2026-78032
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...
CVE-2026-78032
SOY CMS is affected by a deserialization of untrusted data vulnerability that allows an attacker to execute arbitrary code with web server privileges . The vulnerability is rated CRITICAL with a CVSS 3.0 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 base score of 9.3 . No...
CVE-2026-75419
go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...
PT-2026-83368
Name of the Vulnerable Software and Affected Versions Silverstripe Versioned versions prior to 3.2.1 Description In the RestoreAction::getRestoreMessage function within src/RestoreAction.php, restore notifications in ArchiveAdmin are rendered as CAST HTML. The system fails to apply Convert::raw2x...
PT-2026-83281
Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...
CVE-2026-79988
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
GHSA-GVRW-QQP5-JGC5 Silverstripe Framework: Possible XSS attack through media embed
Impact The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. Reported by Jack Wallace from Bastion Security...
Silverstripe Framework: Possible XSS attack through media embed
Impact The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. Reported by Jack Wallace from Bastion Security...
EUVD-2026-67081
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988
CVE-2026-79988 affects Craft CMS , where the Twig sandbox mechanism is misconfigured to allow dangerous functionality from the Yii framework , enabling authenticated remote code execution (RCE) . The vulnerability is rated CVSS 8.7 (HIGH) with a low complexity, network-based attack vector requiri...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-12802
A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to compromise the integrity of data during the decryption of Cryptographic Message Syntax CMS AuthEnvelopedData. The software fails to properly enforce the tag-length, which could enable an attacker to...
