Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that ...

PT-2026-120921

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that ...

CLSA-2026-1770215200 microcode_ctl: Fix of CVE-2022-41804

Update Intel CPU microcode to 20251111: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000410; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b000650; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...

Nx: OS command injection via git revisions and remote refs

Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...

NPM: Nx: OS command injection via git revisions and remote refs

NPM: Nx: OS command injection via git revisions and remote refs vulnerability discovered by ? in WordPress Npm nx versions = 14.0.0, 22.7.8...

CVE-2026-84205

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-84205

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

CVE-2026-84205: Authorization Bypass Through User-Controlled Key

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...

PT-2026-84303

GROWI contains an access control vulnerability in the GET / api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier...

CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-81658

Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...

CVE-2026-49224

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49224 Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49225

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

EUVD-2026-61036

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

CVE-2026-49225

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

PT-2026-77205

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4 Description Backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The 'admin/controller/content/revisions.php' controller and 'admin/sql/sqlite/pos...

PT-2026-77206

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

DRUPAL-CONTRIB-2026-096

This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity...

CVE-2026-50749 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...