CISCO-SA-20161102-CMS

creationtimestamp| type| source ---|---|--- 2026-08-22 14:00:17+00:00| seen| https://t.me/informationsec/1437 2026-08-23 00:00:36+00:00| seen| https://t.me/informationsec/1437...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2026-63421 via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2026-63421 Source advisory: SNYK:JS-KEYSTONE6CORE-20158545...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2026-63421 via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2026-63421 Source advisory: OSV:GHSA-CQMQ-8755-7XVH...

Exploit for SQL Injection in Ghost

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content AP...

SUSE CVE-2026-76881

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

SUSE CVE-2026-76921

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-52021

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

CVE-2026-63003

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:15+00:00| published-proof-of-concept| https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr...

CVE-2026-61663

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:13+00:00| published-proof-of-concept| https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399...

CVE-2026-75526

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-63003

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

CVE-2026-61663

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...

CVE-2026-54624

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-54622

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

Improper Handling of Insufficient Permissions or Privileges

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges in the copy for snippets. An attacker can gain unauthorized access to the contents of existing snippets by...

Improper Handling of Insufficient Permissions or Privileges

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the API V2. An attacker can access filenames and names of documents and images in descendant collection...

GHSA-HQ84-X37P-J6Q5 Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the search parameter in the backend Table widget partial. An attacker can execute arbitrary scripts in the context of an authenticated backend user by enticing the user to follow a crafted link. This is only...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the actionExists process. An attacker can cause destructive changes to system state, such as truncating logs, resetting settings, altering user states, or deleting templates, by tricking an...