CVE-2026-58657 Grav - Stored CSS Injection via Markdown Image resize() Action

Grav before 2.0.0 affected through 2.0.0-rc.9 and the 2.0 branch contains a stored CSS injection vulnerability in the Markdown image resize media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the resize action in Excerpts::processMediaActions...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-34182 DESCRIPTION: Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fiel...

aldryn-django-cms (3.5.3.2), django-fias (1.2.2) +1 more potentially affected by CVE-2025-48383 via django-select2 (6.3.1)

django-select2 PYPI version 6.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - aldryn-django-cms 3.5.3.2 - django-fias 1.2.2 - stem-registration =0.0.27, =0.0.49 Source cves: CVE-2025-48383 Source advisory:...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-53877 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

arches (>=6.2.5, <=7.4.2), botbuilder-applicationinsights (>=0.0.1, <=4.14.8) +3 more potentially affected by CVE-2026-48588 via django (3.2.21)

django PYPI version 3.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - arches =6.2.5, =0.0.1, =0.0.1, =2024.5.0, =2024.6.0 - nemo 4.6.4 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-53878 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-48588 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

arches (>=6.2.5, <=7.4.2), botbuilder-applicationinsights (>=0.0.1, <=4.14.8) +3 more potentially affected by CVE-2026-53877 via django (3.2.21)

django PYPI version 3.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - arches =6.2.5, =0.0.1, =0.0.1, =2024.5.0, =2024.6.0 - nemo 4.6.4 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

django-cms-qe (1.4.3) potentially affected by CVE-2024-11404 via django-filer (1.3.2)

django-filer PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-filer and may be impacted: - django-cms-qe 1.4.3 Source cves: CVE-2024-11404 Source advisory: OSV:PYSEC-2026-1298...

taccsite-cms (3.6.0a0) potentially affected by CVE-2024-11406 via djangocms-attributes-field (2.0.0)

djangocms-attributes-field PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - taccsite-cms 3.6.0a0 Source cves: CVE-2024-11406 Source advisory: OSV:PYSEC-2026-1303...

PYSEC-2026-1298 Django Filer Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3....

django-cms-qe (>=1.4.3, <=2.2.0), django-danceschool (>=0.6.2, <=0.8.3) +1 more potentially affected by CVE-2024-11406 via djangocms-attributes-field (1.2.0)

djangocms-attributes-field PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on djangocms-attributes-field and may be impacted: - django-cms-qe =1.4.3, =0.6.2, =2.28.1, =2.39.2 Source cves: CVE-2024-11406 Source advisory: OSV:PYSEC-2026-1...

PYSEC-2026-1303 django CMS Attributes Field Cross-site Scripting

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2024-45231 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

Lin CMS vulnerable to Improper Authentication

An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator...

PYSEC-2026-839 Lin CMS vulnerable to Improper Authentication

An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator...

Linux Distros Unpatched Vulnerability : CVE-2026-58467

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cockpit CMS before release 364 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or...

Security Bulletin: Vulnerable Version of Software in Use

Summary Prior versions include vulnerable version of openssl. Vulnerability Details CVEID:CVE-2026-28390 DESCRIPTION: Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that...

GHSA-F74W-488G-8X5R Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Requirements: Control panel access Permissions to edit an entry Details Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a...