CVE-2026-54622

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

CVE-2026-2334 ) Missing Server-Side File Extension Validation in vsDesk

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54623

django CMS prior to 5.0.8 is vulnerable to a denial-of-service via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier, allowing a staff user with plugin-c...

GHSA-RRWH-6JRQ-WP5V

creationtimestamp| type| source ---|---|--- 2026-08-20 17:51:42+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mtjsq4tke52x...

CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-55095

In OpenProject ≤17.5.1, the inplace-edit dialog resolves project custom fields by raw identifier without enforcing the admin_only visibility scope, leaking hidden admin-only comment text to authenticated non-admin members. CVSS 5.3 MEDIUM. Fixed in 17.6.0. No public exploitation observed.

CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

EUVD-2026-63463

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-76997

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

EUVD-2026-63395

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=deletecategory. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack...

CVE-2026-76998

CVE-2026-76998 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 , located in the file /admin/ajax.php when the action=delete_category parameter is used. Manipulation of the ID argument allows an unauthenticated remote attacker to inject SQL commands. The v...

CVE-2026-76995

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. Th...

EUVD-2026-63394

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-76997

CVE-2026-76997 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 , located in the file /admin/ajax.php?action=save_category. Manipulation of the ID parameter allows a remote, authenticated attacker to inject SQL queries. The vulnerability is rated MEDIUM se...

CVE-2026-76995

The description states the exploit is publicly available but no exploit code or proof-of-concept is included in the provided documents, so actual exploitation status cannot be confirmed here.

CVE-2026-44725 EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...

CVE-2026-64967

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is...

CVE-2026-64961

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-76635 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...