CVE-2026-55231 Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

CVE-2026-55231

The Vvveb CMS is vulnerable to a path traversal flaw in its central path sanitizer, specifically affecting versions prior to 1.0.8.6 . An authenticated user with backup access (e.g., site_admin role or higher) can exploit this to read and delete arbitrary files on the server. Impacted actions inc...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059

Lektor versions 3.3.14 and 3.4.0b15 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the admin API blueprint . The root cause is a lack of CSRF tokens, Origin/Referer validation, CORS configuration, and Host allowlisting. This allows unauthenticated attackers to perform ...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

EUVD-2026-91007

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

auditorium (>=0.6.1, <=19.1.1), gino-admin (>=0.0.1, <=0.2.1) +9 more potentially affected by CVE-2026-85078 via sanic (19.12.5)

sanic PYPI version 19.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - auditorium =0.6.1, =0.0.1, =1.5.0, =1.4.0, =1.5.0, =0.0.2, =0.1.0, =0.1.2, =1.7.0, =0.1.0, =0.2.0 Source cves: CVE-2026-85078 Source advisory:...

PYSEC-2026-4047 djust has an authorization bypass on the WebSocket/SSE mount path

Impact The live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @methoddecoratorloginrequired, name="dispatch", and custom dispatch guards — a...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-15307 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

django-crispy-admin (0.0.6), django-es-utils (>=0.0.3, <=1.0.3) +4 more potentially affected by CVE-2026-15307 via django (1.8.0)

django PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-crispy-admin 0.0.6 - django-es-utils =0.0.3, =0.1.0, =1.0.0, =1.1.3 - teamvault 0.4.1 Source cves: CVE-2026-15307 Source advisory:...

PYSEC-2026-4068 LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

LiteLLM: Admin Key Handler Has Improper Authorization

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/managementendpoints/keymanagementendpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

Exploit for CVE-2026-62059

CVE-2026-62059 - Ultimate Member Stored SQL Injection Validati...

CVE-2024-27198-EXPLOIT

CVE-2024-27198 - JetBrains TeamCity Authentication Bypass JetBrains TeamCity before 2023.11.4 is affected by an authentication bypass vulnerability that allows unauthorized users to perform admin actions. Impact The vulnerability's exploitation is critical as it grants attackers admin-level acces...

Insertion of Sensitive Information Into Sent Data

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the Admin API, which returns API keys to authenticated low-privilege staff users who should not have access to them. These keys are intended to be...

Incorrect Authorization

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Incorrect Authorization via the Admin Feedback endpoint, which lacks proper authorization checks for staff-level users. An authenticated attacker with staff privileges can query the feedback endpoint to...

Relative Path Traversal

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Relative Path Traversal via improper input validation in the admin iframe, which allows an attacker with content publishing privileges to craft malicious pages that, when visited by an active staff user,...

Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the oEmbed preview feature, which fails to sandbox externally hosted scripts. An attacker can craft malicious oEmbed content that executes arbitrary scripts in the context of a...