54613 matches found
Security Bulletin:Vulnerability in OpenSSL affects IBM Netezza Appliance
Summary The OpenSSL package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-42768 Vulnerability Details CVEID:CVE-2026-42768 DESCRIPTION: Issue summary: The CMSdecrypt and PKCS7decrypt functions are vulnerable to Bleichenbacher-style attack when a...
Security Bulletin:Vulnerability in OpenSSL affects IBM Netezza Appliance
Summary The OpenSSL package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-42766 Vulnerability Details CVEID:CVE-2026-42766 DESCRIPTION: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference duri...
django-cms-qe (1.4.3), django-import-export (2.0.1) +1 more potentially affected by CVE-2026-9318 via tablib (0.14.0)
tablib PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on tablib and may be impacted: - django-cms-qe 1.4.3 - django-import-export 2.0.1 - iambic 1.0.0 Source cves: CVE-2026-9318 Source advisory: OSV:GHSA-GQGW-JGHV-MXWX...
apis-core (>=0.14.0, <=0.14.1), iambic (>=2.0.1, <=2.3.3) +2 more potentially affected by CVE-2026-9318 via tablib (2.0.0)
tablib PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on tablib and may be impacted: - apis-core =0.14.0, =2.0.1, =0.3.0a2, =0.3.0a3 - taccsite-cms 3.6.0a0 Source cves: CVE-2026-9318 Source advisory: OSV:GHSA-GQGW-JGHV-MXWX...
PT-2026-75987
Impact The Backend Filter widget BackendWidgetsFilter is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via th...
PT-2026-76553
Name of the Vulnerable Software and Affected Versions Winter versions 1.2.10 through 1.2.12 Description Authenticated backend users with the backend.manage editor permission can store custom Markup Styles via Settings → Editor Settings → Markup Styles. These styles are compiled by the LESS parser...
PT-2026-76552
Name of the Vulnerable Software and Affected Versions Winter versions prior to 1.2.13 Description Custom CSS provided through the Brand Settings Styles field is compiled by the LESS parser and rendered without sanitization on every backend page. This allows a user with the backend.manage branding...
PT-2026-75930
Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller CmsControllersIndex used OR-logic across its five permissions cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage...
PT-2026-71228
Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...
PT-2026-76554
Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description Theme Editor AJAX handlers in the CMS section do not enforce per-template-type permission checks. While the CMS controller CmsControllersIndex uses OR-logic across five permissions cms.manage...
PT-2026-76556
Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description An issue exists where the backend fails to validate the handler name submitted via the handler POST field during form postbacks. While AJAX requests are validated against the onA-Zw+ pattern, the...
CVE-2026-72786: Improper Authorization
Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...
CVE-2026-72787: Improper Neutralization of Input During Web Page Generation
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...
PT-2026-71229
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...
PT-2026-75979
Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests X WINTER REQUEST HANDLER header. The AJAX path validates that handler names match the onA-Zw+ pattern, but the postback path...
PT-2026-78857
Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A Use After Free issue in the CMS protocol dissector can lead to a crash, resulting in a denial of service. Recommendations Update Wireshark versions...
WordPress wp-login.php Code Execution
The vulnerability of the wp-login.php file in the WordPress content management system is related to the lack of security measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-72782
creationtimestamp| type| source ---|---|--- 2026-08-11 20:45:14+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-craft-cms-1...