CLSA-2026-1784077481 TuxCare security update for craftcms/cms (3 CVEs)

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

CLSA-2026-1783904621 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p5+tuxcare...

CLSA-2026-1783386121 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the drafts endpoint in the administrative interface. An attacker can create unauthorized draft posts by sending requests with only session authentication, thereby bypassing intended role and permission checks...

CVE-2026-70552: Missing Authentication for Critical Function

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

CVE-2026-70553: Improper Control of Generation of Code

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious...

PT-2026-75422

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

PT-2026-75378

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p5+tuxcare...

SUSE SLES15: libopenssl-1_0_0-devel / libopenssl10 / libopenssl1_0_0 / etc (SUSE-SU-2026:3443-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3443-1 advisory. This update for openssl-100 fixes the following issue: - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS...

PT-2026-67840

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.6 Description An authentication bypass exists in the AJAX dispatcher. Unauthenticated attackers can access admin-gated endpoints by providing any X-Requested-With header and requesting a base64-encoded path th...

PT-2026-67841

Name of the Vulnerable Software and Affected Versions MaxSite CMS affected versions not specified Description An issue allows unauthenticated attackers to achieve persistent remote code execution as the web-server process user. By submitting crafted POST requests to the 'install' endpoint after t...

PT-2026-74105

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare...

PT-2026-67873

Name of the Vulnerable Software and Affected Versions Ghost versions 4.22.0 through 6.54.0 Description Ghost is a Node.js content management system. A missing validation check allows users to redeem subscription offers that are no longer active. Recommendations Update to version 6.54.1...

PT-2026-67848

Name of the Vulnerable Software and Affected Versions MaxSite CMS affected versions not specified Description An issue exists where unauthenticated attackers can execute arbitrary code by providing malicious serialized data through the maxsite comuser cookie. The application passes this data...

PT-2026-67887

Name of the Vulnerable Software and Affected Versions Ghost versions 2.2.0 through 6.54.0 Description Ghost Admin fails to invalidate existing sessions during the login process, which could enable session fixation attacks. Session fixation is a method where an attacker provides a valid session...

PT-2026-74443

TuxCare rebuilt craftcms/cms to address 2 CVEs. Fixed in 3.9.15-p2+tuxcare...

PT-2026-75317

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

CVE-2026-70554: Deserialization of Untrusted Data

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

PT-2026-74562

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p3+tuxcare...

PT-2026-67884

Name of the Vulnerable Software and Affected Versions Ghost versions 0.10.0 through 6.54.0 Description A Server-Side Request Forgery SSRF exists in the Ghost Admin image fetching feature. This allows any user with staff-level privileges to execute blind HTTP GET requests against internal hosts...