CVE-2026-93365 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

CVE-2026-93365 Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

EUVD-2026-87207

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-93364

Bludit CMS versions through 3.22.0 are vulnerable to a mass assignment vulnerability within the Pages::edit() function located in bl-kernel/pages.class.php. The root cause is that the application iterates through all fields declared in dbFields without implementing per-field authorization. This a...

CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

CVE-2026-76921

A flaw was found in Wireshark. A use-after-free vulnerability exists in the CMS Cryptographic Message Syntax protocol dissector. An attacker could exploit this by crafting a malicious network packet, leading to a crash and a denial of service DoS for the application. Mitigation To mitigate this d...

CVE-2026-93366: Authorization Bypass Through User-Controlled Key

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints...

CVE-2026-93365: Missing Authorization

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

CVE-2026-93364: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

PT-2026-98954

Name of the Vulnerable Software and Affected Versions Bludit CMS versions prior to 3.22.1 Description An authorization bypass allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators. This occurs by...

PT-2026-98952

Name of the Vulnerable Software and Affected Versions Bludit CMS versions prior to 3.22.1 Description Authenticated users with the Author role can modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. This occurs because the...

PT-2026-98953

Name of the Vulnerable Software and Affected Versions Bludit CMS versions prior to 3.22.1 Description Authenticated users with the Author or Editor role can access the full content of private drafts and scheduled posts from any other user, including administrators. This occurs via the...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

CVE-2026-96881

A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attac...

CVE-2026-96882

A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper...

CVE-2026-96882 TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization

A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper...

CVE-2026-96882

The TaleLin lin-cms-spring-boot software, specifically versions up to 0.2.1 , contains an improper authorization vulnerability. The issue resides in the searchBook function within the src/main/java/io/github/talelin/latticy/controller/v1/BookController.java file of the book Endpoint component. Th...