CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

CVE-2026-64664

Statamic CMS (Laravel/Git) contains a privacy-related flaw fixed in 5.74.1 and 6.24.0. Before these versions, an authenticated Control Panel user could call the endpoint intended for the user creation wizard to determine whether a given email exists in the system, even without permission to view ...

CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

PT-2026-68926

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...

PT-2026-76001

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

PT-2026-70178

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses...

PT-2026-75917

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

PT-2026-68977

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0...

PT-2026-75910

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...

EUVD-2026-51573

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context...

CVE-2026-25424

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424 WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424

CVE-2026-25424 concerns the WordPress Mediavine Control Panel plugin, affected in versions

EUVD-2026-48148

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424 WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

CVE-2026-25424: Missing Authorization

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

PT-2026-63806

Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...

WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Mediavine Control Panel versions = 2.10.10...

Plone 5.2.3 XSS

The version of Plone installed on the remote host is 5.2.3. It is, therefore, affected by a stored cross-site scripting XSS vulnerability within the site-controlpanel due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this...

CVE-2026-54244

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A...