CVE-2026-93455

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93456 django-page-cms through 2.0.13 CSRF via admin mutation views

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

EUVD-2026-82615

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93456 django-page-cms through 2.0.13 CSRF via admin mutation views

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-93455

django-page-cms through 2.0.13 fails to properly validate page permissions in its admin helper views (specifically in pages/admin/views.py). This allows any staff account with low-privilege credentials to read arbitrary page content and stored media paths, enumerate content identifiers, and acces...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93456

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. A signed-in editor visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, en...

CVE-2026-93455: Missing Authorization

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93659: Improper Neutralization of Input During Web Page Generation

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93456: Cross-Site Request Forgery (CSRF)

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

PT-2026-94121

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description The live WebSocket transport authorizes a mount using the check view auth function instead of the standard Django View.dispatch chain. This causes standard Django authorization mechanisms—such as...

CVE-2026-81898 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

Chromium CVE-2026-87644: Incorrect authorization in Views

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87633: Use after free in Views

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87616: Improper initialization in Views

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87569: Missing authorization in Views

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87514: Use after free in Views

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

ROS-20260915-73-0151

The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-92098

Vikunja before 2.6.0 fails to validate that user-supplied project view id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...