191727 matches found
GHSA-C2XX-CJMH-9Q8F Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Impact The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections...
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Impact The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections...
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ImportExportController AJAX handlers due to insufficient enforcement of granular access control. An attacker can access or modify sensitive data by invoking import or export operations through AJAX handler...
GHSA-6X92-6VX4-5FWR django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...
GHSA-3VRH-M9W7-V94F Wagtail: Improper restriction handling on Pages admin API
Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...
Wagtail: Improper restriction handling on Pages admin API
Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...
django CMS: Structure endpoint bypasses page-view permission
Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...
Wagtail: Improper permission handling in image preview
Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...
DEBIAN-CVE-2026-63385
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...
AZL-96897 CVE-2026-63385 affecting package libtevent 0.14.1-1
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...
AZL-97539 CVE-2026-63385 affecting package mysql for versions less than 8.0.46-2
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...
AZL-97566 CVE-2026-63385 affecting package ntp for versions less than 4.2.8p17-3
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...
CVE-2026-63385
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...
DEBIAN-CVE-2026-63382
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...
AZL-97560 CVE-2026-63382 affecting package ntp for versions less than 4.2.8p17-3
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...
[SECURITY] [DSA 6454-1] sabnzbdplus security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6454-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 20, 2026 https://www.debian.org/security/faq -...
CVE-2026-53569
In Frappe framework ≤16.31.0, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py skip read-permission checks before modifying _liked_by metadata or a Note's seen state. An authenticated low-privilege user can thus probe for resource ...
EUVD-2026-63574
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...