CVE-2026-104059

Lektor versions 3.3.14 and 3.4.0b15 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the admin API blueprint . The root cause is a lack of CSRF tokens, Origin/Referer validation, CORS configuration, and Host allowlisting. This allows unauthenticated attackers to perform ...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

auditorium (>=0.6.1, <=19.1.1), gino-admin (>=0.0.1, <=0.2.1) +9 more potentially affected by CVE-2026-85078 via sanic (19.12.5)

sanic PYPI version 19.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - auditorium =0.6.1, =0.0.1, =1.5.0, =1.4.0, =1.5.0, =0.0.2, =0.1.0, =0.1.2, =1.7.0, =0.1.0, =0.2.0 Source cves: CVE-2026-85078 Source advisory:...

PYSEC-2026-4047 djust has an authorization bypass on the WebSocket/SSE mount path

Impact The live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — a...

django-crispy-admin (0.0.6), django-es-utils (>=0.0.3, <=1.0.3) +4 more potentially affected by CVE-2026-15307 via django (1.8.0)

django PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-crispy-admin 0.0.6 - django-es-utils =0.0.3, =0.1.0, =1.0.0, =1.1.3 - teamvault 0.4.1 Source cves: CVE-2026-15307 Source advisory:...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-15307 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

PYSEC-2026-4068 LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

Exploit for CVE-2026-62059

CVE-2026-62059 - Ultimate Member Stored SQL Injection Validati...

CVE-2024-27198-EXPLOIT

CVE-2024-27198 - JetBrains TeamCity Authentication Bypass JetBrains TeamCity before 2023.11.4 is affected by an authentication bypass vulnerability that allows unauthorized users to perform admin actions. Impact The vulnerability's exploitation is critical as it grants attackers admin-level acces...

Insertion of Sensitive Information Into Sent Data

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the Admin API, which returns API keys to authenticated low-privilege staff users who should not have access to them. These keys are intended to be...

Incorrect Authorization

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Incorrect Authorization via the Admin Feedback endpoint, which lacks proper authorization checks for staff-level users. An authenticated attacker with staff privileges can query the feedback endpoint to...

Relative Path Traversal

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Relative Path Traversal via improper input validation in the admin iframe, which allows an attacker with content publishing privileges to craft malicious pages that, when visited by an active staff user,...

Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the oEmbed preview feature, which fails to sandbox externally hosted scripts. An attacker can craft malicious oEmbed content that executes arbitrary scripts in the context of a...

gvfs security update

An update is available for gvfs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GVFS is the GNOME Desktop Virtual File System layer that allows users to easily...

RLSA-2026:73998 Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103284

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without...

CVE-2026-103281

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...