54688 matches found
PT-2026-80221
Summary The clipboard copy paths of the copy plugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...
CVE-2026-52021
The code100xDevs 100xdevs CMS v.1.0 (2026-04-30) is affected by a vulnerability that allows a remote attacker to obtain sensitive information . The flaw exists within the src/middleware.ts and src/app/api/mobile/search/route.ts components. While the vulnerability is documented with a HIGH base se...
PT-2026-80770
Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2 Description The internal Pages admin API returns page fields declared in api fields without sufficient access...
PT-2026-79095
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description Page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde...
PT-2026-79094
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description The render object structure function fails to properly authorize non-PageContent objects that utilize PlaceholderRelationField. An active staff user lacking cms.use structure or model-level view o...
CVE-2026-75526: Improper Neutralization of Input During Web Page Generation
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...
PT-2026-79101
Name of the Vulnerable Software and Affected Versions django CMS versions 5.0.8 through 5.0.8 Description In edit mode, the ContentRenderer.render placeholder function in cms/plugin rendering.py can pass stored, attacker-controlled values to the ContentRenderer.render exception function when plug...
PT-2026-83652
Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...
PT-2026-79091
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...
PT-2026-79092
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The render object structure function in cms/views.py renders cms/toolbar/structure.html for a PageContent object without verifying permissions via the user can view page function. When CMS...
PT-2026-80786
Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...
PT-2026-79093
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 django CMS version 5.1.0a1 Description The page cache in cms/cache/page.py ignores request headers declared by plugins through the get vary cache on function. While the page cache key function includes the...
Linux Distros Unpatched Vulnerability : CVE-2026-76881
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76881 Note that Nessus relies on the presence of the packag...
CVE-2026-76921
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
DEBIAN-CVE-2026-76921
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
AZL-96930 CVE-2026-76921 affecting package wireshark 4.4.7-2
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76881
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
DEBIAN-CVE-2026-76881
CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
