CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

PT-2026-70178

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses...

EUVD-2026-51573

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context...

CVE-2026-25424

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424 WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424 WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

EUVD-2026-48148

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424

CVE-2026-25424 concerns the WordPress Mediavine Control Panel plugin, affected in versions

PT-2026-63806

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424: Missing Authorization

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Mediavine Control Panel versions = 2.10.10...

Plone 5.2.3 XSS

The version of Plone installed on the remote host is 5.2.3. It is, therefore, affected by a stored cross-site scripting XSS vulnerability within the site-controlpanel due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this...

EUVD-2026-45319

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A...

CVE-2026-54244

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A...

CVE-2026-54243: Improper Neutralization of Formula Elements in a CSV File

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula...

ROS-20260716-73-0023

The vulnerability of the History control panel element in Google Chrome is related to information representation errors in the user interface. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

CVE-2026-49353

Summary (CVE-2026-49353): 9Router before 0.4.46 has a local‑only access gate in src/dashboardGuard.js that relies on Host and Origin headers to classify requests as local. In proxied/tunneled deployments (reverse proxy, Cloudflare Tunnel, Tailscale), these headers are attacker‑controlled, enablin...

CVE-2025-30008 HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars encoding ...

CVE-2025-30007 HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in...

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Requirements: Control panel access Permissions to edit an entry Details Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a...