2002 matches found
CVE-2026-32258 Winter: Stored XSS through Editor Settings custom styles
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...
CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...
EUVD-2026-66632
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...
CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...
CVE-2026-32257
Winter CMS is an open-source content management system based on the Laravel PHP framework. Prior to 1.2.13 , custom CSS supplied through the Brand Settings Styles field by a user with the backend.manage_branding permission was compiled by the LESS CSS parser and rendered without sanitization on e...
CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...
CVE-2026-80585
This vulnerability affects the Linux kernel's MPTCP (Multipath TCP) Fast Open implementation. The function mptcp_fastopen_subflow_synack_set_params() incorrectly set the is_mptfo flag before verifying that SYN data had actually been queued on the child socket's receive queue. Data-less TFO SYNs (...
CVE-2026-32258: Improper Neutralization of Input During Web Page Generation
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manageeditor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on...
CVE-2026-32257: Improper Neutralization of Input During Web Page Generation
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.managebranding permission is compiled by the LESS parser and rendered without sanitizatio...
CVE-2026-63179: Improper Limitation of a Pathname to a Restricted Directory
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...
PT-2026-82201
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Multipath TCP MPTCP implementation regarding TCP Fast Open TFO. The function mptcp fastopen subflow synack set params incorrectly sets the is mptfo flag before...
GHSA-58FP-MCX6-7QF9 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of @import directives in LESS compilation within backend customizable stylesheets and theme assets. An attacker can disclose arbitrary files readable by the PHP process by injecting crafted import...
PT-2026-80786
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...
PT-2026-79989
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshtein less equal. Versions before PostgreSQL 18.6, 17.11,...
EUVD-2026-60793
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-68315 affecting package kernel for versions less than 6.6.150.1-1
CVE-2026-68315 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...