CVE-2026-64757

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory corruption issue due to improper state management and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-64719

A flaw was found in WebKitGTK. Processing malicious web content can cause an out-of-bounds access issue due to improper bounds checking and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-28984

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2026-63003

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

GHSA-6X92-6VX4-5FWR django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

GHSA-4XFR-4P46-GC6P django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

EUVD-2026-41147

Wagtail: Improper restriction handling on Documents and Images chosen endpoints...

CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-54625

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-63003 django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

CVE-2026-61663 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...

CVE-2026-54622 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

EUVD-2026-63568

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

CVE-2026-54622 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-54625

django CMS prior to 5.0.8 and in 5.1.0a1 contains a page cache vulnerability in cms/cache/page.py. The _page_cache_key function omits request header values declared by plugins through get_vary_cache_on() from the cache key, even though set_page_cache correctly adds those header names to the respo...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...