PT-2026-70178

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71238: Use of Hard-coded Credentials

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

EUVD-2026-52487

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-69082

CTI-Transmute exposes a CSRF vulnerability in the admin user-deletion endpoint: /account/delete/ accepts HTTP GET, allowing an attacker to induce an authenticated admin to delete a user via a forged request. Exploitation requires an active admin session but no CTI-Transmute account or admin privi...

PT-2026-67341

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via omission of the VerifyCsrfToken middleware in the global middleware stack. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious...

SUSE CVE-2026-45327

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a ?password= query parameter, comparing the supplied...

OPENSUSE-SU-2026:21496-1 Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issues: Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh random value on every request, instead of being reused for the whole...

openSUSE 16 Security Update : perl-Mojolicious (openSUSE-SU-2026:21451-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21451-1 advisory. Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now mask...

CVE-2026-48060 Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

CVE-2026-14856

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

CVE-2026-14856 Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

PT-2026-64876

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the wap/authorize.ftl consent template in the OAuth2/OIDC consent page. An attacker can execute arbitrary JavaScript in the OpenAM origin by sending a victim with an active session a crafted display=wap...

CVE-2026-64871

The Joomla Extension Cache Cleaner by regularlabs.com is vulnerable to inconsistent CSRF token checks and privilege checks . Specifically, Administrator URL purges do not consistently require a valid token or proper cache-management permission . This could allow an attacker to perform unauthorize...

CVE-2026-64871 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission...

CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens...