CVE-2026-54623

django CMS prior to 5.0.8 is vulnerable to a denial-of-service via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier, allowing a staff user with plugin-c...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-54625

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-54625

django CMS prior to 5.0.8 and in 5.1.0a1 contains a page cache vulnerability in cms/cache/page.py. The _page_cache_key function omits request header values declared by plugins through get_vary_cache_on() from the cache key, even though set_page_cache correctly adds those header names to the respo...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

GHSA-RRWH-6JRQ-WP5V

creationtimestamp| type| source ---|---|--- 2026-08-20 17:51:42+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mtjsq4tke52x...

CVE-2026-76881

A flaw was found in Wireshark. A NULL pointer dereference vulnerability exists within the CMS Cryptographic Message Syntax protocol dissector. This issue can be triggered by processing a specially crafted network capture file, leading to an application crash. A remote attacker could exploit this ...

EUVD-2026-63170

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

EUVD-2026-63138

CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-52021

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

CVE-2026-52021

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

PT-2026-80240

Impact The only authorization gate on the duplicate flow is PageAdmin.has add permission, which checks user can add pageuser, site / user can add subpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

PT-2026-80221

Summary The clipboard copy paths of the copy plugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

Linux Distros Unpatched Vulnerability : CVE-2026-76881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76881 Note that Nessus relies on the presence of the packag...

CVE-2026-52021: Exposure of Sensitive Information to an Unauthorized Actor

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

PT-2026-83659

Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level GET navigation with no CSRF token. BackendClassesController::actionExists accepted any public method on a controller as a page action, so handler-shaped names were never reserved from URL...

PT-2026-79135

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

PT-2026-80315

Summary The structure-board endpoint render object structure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via render page, but the structure endpoint does not, allowing a low-privileged staff...