PT-2026-68756

Name of the Vulnerable Software and Affected Versions Silverstripe CMS versions prior to 6.2.1 Description Page breadcrumbs in the CMS are susceptible to cross-site scripting XSS when accessed via the page list view. This occurs because page titles are rendered into the breadcrumb trail without...

CVE-2026-54717: Improper Neutralization of Input During Web Page Generation

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1...

PT-2026-70178

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An authenticated remote code execution issue exists in the control panel element-search condition handling. The software uses...

PT-2026-68496

Name of the Vulnerable Software and Affected Versions Loca Software Informatics Technology Ltd. Co. CMS versions prior to 06082026 Description An SQL injection issue exists due to the improper neutralization of special elements used in an SQL command. This allows an attacker to execute arbitrary...

EulerOS 2.0 SP13 : lcms2 (EulerOS-SA-2026-3023)

According to the versions of the lcms2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

TencentOS Server 3: java-21-openjdk (TSSA-2026:0807)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0807 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-5134: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...

PT-2026-75910

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...

PT-2026-68951

The reorder-sets action in Craft CMS’s GlobalsController is missing the requireAdmin check that the adjacent save-set and delete-set actions both enforce. Any authenticated control panel user can POST to /actions/globals/reorder-sets and permanently reorder all global sets in the project config,...

PT-2026-75962

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE in a manner similar to previously disclosed vulnerabilities. The Twig sandbox in Craft CMS works by implementing Twig's SecurityPolicyInterface. The resultin...

PT-2026-70199

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.6 Craft CMS versions 4.0.0-RC1 through 4.18.2 Description A remote code execution issue exists in the Twig sandbox mechanism. The software marks the ElementInterface as safe using the AllowedInSandbox...

PT-2026-70201

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1 Description A theoretical path traversal weakness exists in the ensurePathIsContained function of the Local file system class. The issue arises because the...

EulerOS 2.0 SP15 : lcms2 (EulerOS-SA-2026-2891)

According to the versions of the lcms2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0809)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0809 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP15 : lcms2 (EulerOS-SA-2026-2932)

According to the versions of the lcms2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

PT-2026-75957

The create Twig function introduced in 5.9.0 allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env security key, DB credentials and the passwd file from...

CVE-2026-70596

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...

CVE-2026-70595

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

GHSA-JPPW-R5J3-XF7X Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...