django-cms-forms (>=0.0.1, <=0.0.11) potentially affected by CVE-2026-54625 via django-cms (3.7.1)

django-cms PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-forms =0.0.1, =0.0.11 Source cves: CVE-2026-54625 Source advisory: OSV:GHSA-FWJF-M4QW-9F2X...

aldryn-forms (>=3.0.4, <=3.0.5), django-cms-qe (>=2.0.0, <=2.2.0) +5 more potentially affected by CVE-2026-54625 via django-cms (3.7.4)

django-cms PYPI version 3.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-forms =3.0.4, =2.0.0, =0.1.0, =0.1.0, =0.2.4 - taccsite-cms 3.6.0a0 Source cves: CVE-2026-54625 Source advisory: OSV:GHSA-FWJF-M4QW-9...

richie (2.15.1) potentially affected by CVE-2026-54625 via django-cms (3.11.0)

django-cms PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie 2.15.1 Source cves: CVE-2026-54625 Source advisory: OSV:GHSA-FWJF-M4QW-9F2X...

django-shop (1.2.4), djangocms-algolia (>=0.1.0.0, <=1.3.2.0) +8 more potentially affected by CVE-2026-54625 via django-cms (3.11.3)

django-cms PYPI version 3.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-shop 1.2.4 - djangocms-algolia =0.1.0.0, =1.0.0, =1.0.0, =0.2.0.0, =0.0.0.1, =1.0.0.0 - djangoshop-gestpay 0.1.0 - djangoshop-wspay...

django-unfold-extra (>=0.1.1, <=0.1.2), djangocms-haystack (>=0.5.0, <=0.5.1) potentially affected by CVE-2026-54625 via django-cms (>=5.0.0a1, <=5.0.6)

django-cms PYPI version =5.0.0a1, =0.1.1, =0.5.0, =0.5.1 Source cves: CVE-2026-54625 Source advisory: OSV:GHSA-FWJF-M4QW-9F2X...

django-unfold-extra (>=0.1.1, <=0.1.2), djangocms-haystack (>=0.5.0, <=0.5.1) potentially affected by CVE-2026-54625 via django-cms (>=5.0.0a1, <=5.0.6)

django-cms PYPI version =5.0.0a1, =0.1.1, =0.5.0, =0.5.1 Source cves: CVE-2026-54625 Source advisory: GHSA-FWJF-M4QW-9F2X...

aldryn-faq (1.0.13), aldryn-people (1.1.1) +1 more potentially affected by CVE-2026-54625 via django-cms (3.2.5)

django-cms PYPI version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-faq 1.0.13 - aldryn-people 1.1.1 - aldryn-snippet 0.1.4.2 Source cves: CVE-2026-54625 Source advisory: OSV:GHSA-FWJF-M4QW-9F2X...

cmsplugin-articles-ai (>=0.1.2, <=0.2.4), cmsplugin-google-maps-ai (0.0.1) +3 more potentially affected by CVE-2026-54625 via django-cms (3.4.7)

django-cms PYPI version 3.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-articles-ai =0.1.2, =0.0.3, =0.4.0 - djangocms-htmlsitemap 0.3.1 - djangocms-slick-slider 0.6.0 Source cves: CVE-2026-54625 Source...

djangocms-htmlsitemap (0.5.0), leprikon (>=2.28.1, <=2.39.2) potentially affected by CVE-2026-54625 via django-cms (3.6.1)

django-cms PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-htmlsitemap 0.5.0 - leprikon =2.28.1, =2.39.2 Source cves: CVE-2026-54625 Source advisory: OSV:GHSA-FWJF-M4QW-9F2X...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

GHSA-8JJ7-4V57-FRF5 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

EUVD-2026-63565

django CMS: Plugin move endpoint allows cyclic reparenting DoS...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the moveplugin process. An attacker can cause application workers to hang and corrupt the plugin tree by reparenting a plugin under itself or one of its descendants, resulting in infinite recursion during tree traversa...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

CVE-2026-78416

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-78416

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-78416 Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

EUVD-2026-64920

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...