CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

EUVD-2026-69905

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84792

Craft CMS versions before 5.10.11 are affected by a broken access control vulnerability in the element-indexes/save-elements endpoint. An attacker with control panel access and limited section permissions can overwrite the sectionId attribute after the initial authorization check, bypassing the d...

CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

EUVD-2026-69904

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

CVE-2026-84793 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

CVE-2026-84793

Craft CMS versions from 5.0.0-RC1 through before 5.10.11 are affected by a stored cross-site scripting (XSS) vulnerability in the site name field . The root cause is a failure to sanitize input in that field, allowing privileged administrators to inject arbitrary JavaScript payloads that execute ...

SUSE-SU-2026:23538-1 Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: - CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate bsc1275145, bsc1274792. - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. - CVE-2026-63076: invalid...

SUSE-SU-2026:23512-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: August 2026 release. - CVE-2026-75803: AEAD forgeries with empty ciphertext when using EVPCipher bsc1275837. - CVE-2026-54874: excessive memory use when buffering DTLS records for a future epoch bsc1274795. - CVE-2026-63072: heap buffer overfl...

openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption

A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax CMS data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key KEK cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leadin...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption

A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax CMS data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key KEK cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leadin...

Ghost_CMS 6.19.0 - Remote Code Execution

Exploit Title: GhostCMS 6.19.0 - Remote Code Execution Date: 08/07/2026 Exploit Author: Maksim Rogov Vendor Homepage: https://ghost.org/ Software Link: https://ghost.org/ Version: = 0.7.2, 'Ghost CMS Remote Code Execution', 'Description' = %q This module exploits a Remote Code Execution RCE...

Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://www.bludit.com/ Software Link: https://github.com/bludit/bludit/archive/refs/tags/3.20.0.zip Version: 3.0.0 through 3.20.0 all versions before commit...

PT-2026-84673

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

CVE-2026-84794: Missing Authorization

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset...

PT-2026-84674

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

PT-2026-84666

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...