PT-2026-65442

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-51078

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

Exploit for CVE-2026-65008

CVE-2026-65008 — Grav CMS 2.0.7 Authenticated RCE Proof-of-...

SUSE-SU-2026:3272-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678. Changes for openssl-100: - Security fix: Fix NULL pointer dereference when processing an OCSP...

Security update for python-Pillow

This update for python-Pillow fixes the following issues: CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes being called without decompressionbombcheck bsc1270409...

CVE-2026-51078: Exposure of Sensitive Information to an Unauthorized Actor

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

PT-2026-65304

Name of the Vulnerable Software and Affected Versions Dede CMS version 5.7.118 Description A remote attacker can obtain sensitive information through the 'file manage control.php' component by manipulating the str parameter. Recommendations At the moment, there is no information about a newer...

CVE-2026-51077

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...

CVE-2026-51078

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

CVE-2026-51078

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

CVE-2026-51078

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information by manipulating the str parameter within the file_manage_control.php component. No information regarding a newer version containing a fix is currently available. To minimize risk, it is recommended to restrict...

CVE-2026-51077: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...

CVE-2026-51077

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...

CVE-2026-51078

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

Ghost CMS CVE-2026-26980 detection

Detects Ghost CMS and confirms CVE-2026-26980 unauthenticated Content API slug filter SQL injection, 3.24.0–6.19.0. Scrapes the public Content API key from HTML, then verifies the EXP710 boolean oracle on /ghost/api/content/tags/. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing...

Exploit for CVE-2026-65694

CVE-2026-65694 — Microweber CMS Unauthenticated Arbitrary File...

Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field

Security Advisory: Camaleon CMS - Authenticated RCE via selec...

CVE-2026-65693

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...

CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...

EUVD-2026-48665

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...