1156 matches found
CVE-2026-54622 django CMS: Clipboard copy IDOR discloses unauthorized plugin content
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...
CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...
CVE-2026-54623
django CMS prior to 5.0.8 is vulnerable to a denial-of-service via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier, allowing a staff user with plugin-c...
CVE-2026-63038
creationtimestamp| type| source ---|---|--- 2026-08-20 16:39:55+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mtjopqokh22y 2026-08-20 18:26:21+00:00| seen| https://infosec.exchange/ap/users/116797276219291526/statuses/117128823263544759...
CVE-2026-77067
creationtimestamp| type| source ---|---|--- 2026-08-20 12:15:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ioucdgto37cls...
CVE-2026-73199
creationtimestamp| type| source ---|---|--- 2026-08-20 12:02:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/emduqmfggpiy6...
OESA-2026-3477 perl-DBI security update
The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...
PT-2026-80254
Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...
CVE-2026-55194
creationtimestamp| type| source ---|---|--- 2026-08-19 23:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthvq3m66v2p 2026-08-22 05:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtnik6j7pn2c...
MINI-G933-5XC7-RWM7
Bulletin has no description...
CVE-2026-63640
A flaw was found in MagicMirror². When the hideConfigSecrets feature is enabled, a connected client can submit a secret placeholder in a socket payload. This causes the server to incorrectly expand the placeholder with sensitive environment variables, such as API tokens or credentials. This...
CVE-2026-58562
creationtimestamp| type| source ---|---|--- 2026-08-19 17:08:26+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mth7tt3cbb25 2026-08-19 17:08:28+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117123272323123431...
MINI-JV69-8QXJ-PF2J
Bulletin has no description...
MINI-FQ7G-Q6CQ-QGH2
Bulletin has no description...
MINI-7RR9-CW2C-2M2P
Bulletin has no description...
MINI-QRF6-GGC7-QMPX
Bulletin has no description...
MINI-3CP9-3274-6W7J
Bulletin has no description...
MINI-MQ62-9W6J-56CW
Bulletin has no description...