CVE-2026-111665

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

CVE-2026-111665

Piranha CMS through version 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController component. This flaw allows any authenticated manager user to perform list, create, edit, and delete actions on site languages without possessing the specific Language , La...

CVE-2026-111665 Piranha CMS through 12.2 Missing Authorization in Manager Language API

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

EUVD-2026-102956

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

CVE-2026-111665 Piranha CMS through 12.2 Missing Authorization in Manager Language API

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

CVE-2026-111665 Piranha CMS through 12.2 Missing Authorization in Manager Language API

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

CVE-2026-111665

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

PT-2026-116064

🚨 CVE-2026-111665 Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or...

CVE-2026-111665: Missing Authorization

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions...

Piranha CMS authorization issue vulnerability

Piranha CMS 12.2 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization in Piranha.Manager LanguageApiController. Any authenticated administrator user can list, create, edit, or delete site languages without having the necessary permissions for...

cloud.piranha.extension:piranha-extension-myfaces (>=22.9.0, <=22.10.0), cloud.piranha:debug (>=22.9.0, <=22.10.0) +56 more potentially affected by CVE-2026-68536 via org.apache.myfaces.core:myfaces-impl (>=4.0.0-rc1, <=4.0.3)

org.apache.myfaces.core:myfaces-impl MAVEN version =4.0.0-rc1, =22.9.0, =22.9.0, =13.0.10.liferay-patched-1, =4.1.0, =4.1.0, =4.1.0, =4.5.1 and more Source cves: CVE-2026-68536 Source advisory: MEND:CVE-2026-68536...

Malicious code in intense-amaranth-piranha (npm)

Source: amazon-inspector b7a779ab82f1633dd34123a92395483b457a16d7096bf99615b1da53fe3a03a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in intellectual-ivory-piranha (npm)

Source: amazon-inspector 0eaa6ed938ed9c158605794b2cf92db78199539297c5bae90f5db0298437b8bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in grieving-azure-piranha (npm)

Source: amazon-inspector 288898beec8fd6a799ea79ebf2a2e60d14375fb264df0592358c611c1158f298 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in enchanting-lime-piranha (npm)

Source: amazon-inspector 6354984ad4e358c6ac622237cd826a5dffd1ef5cb490323c749a6908fdc3e8a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in economic-teal-piranha (npm)

Source: amazon-inspector b297d94c842fc2e97ed3e4b38222ec988b622520bb713d2af558e8c90d792d0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dusty-jade-piranha (npm)

Source: amazon-inspector 50e4c9b64f2d6f49f51711bb433ada582350b0a007a8065b7183950e9df8a4c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in diverse-tomato-piranha (npm)

Source: amazon-inspector 09cdfbc7391bc8518fc084dd05454910e1f90cd03774a8fbad364eee9ed38849 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in conventional-coral-piranha (npm)

Source: amazon-inspector 9594abe83e004cb8eaf79d29b2d47e8ad4d2fd601a175915fa3e479acf2cb4b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in conventional-red-piranha (npm)

Source: amazon-inspector 814aa4f0dfc74d0fefe9c5ac4ebfe61e0fc891e5368bc14191c2017623391dfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...