45640 matches found
CVE-2026-78032
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege...
CVE-2026-78032
SOY CMS is affected by a deserialization of untrusted data vulnerability that allows an attacker to execute arbitrary code with web server privileges . The vulnerability is rated CRITICAL with a CVSS 3.0 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 base score of 9.3 . No...
CVE-2026-75419
go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...
PT-2026-83368
Name of the Vulnerable Software and Affected Versions Silverstripe Versioned versions prior to 3.2.1 Description In the RestoreAction::getRestoreMessage function within src/RestoreAction.php, restore notifications in ArchiveAdmin are rendered as CAST HTML. The system fails to apply Convert::raw2x...
PT-2026-83281
Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...
CVE-2026-79988
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
GHSA-GVRW-QQP5-JGC5 Silverstripe Framework: Possible XSS attack through media embed
Impact The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. Reported by Jack Wallace from Bastion Security...
Silverstripe Framework: Possible XSS attack through media embed
Impact The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. Reported by Jack Wallace from Bastion Security...
CVE-2026-79988
CVE-2026-79988 affects Craft CMS , where the Twig sandbox mechanism is misconfigured to allow dangerous functionality from the Yii framework , enabling authenticated remote code execution (RCE) . The vulnerability is rated CVSS 8.7 (HIGH) with a low complexity, network-based attack vector requiri...
EUVD-2026-67081
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-79988 Authenticated RCE through Twig sandbox escape
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities...
CVE-2026-12802
A flaw was found in Bouncy Castle for Java. This vulnerability allows a remote attacker to compromise the integrity of data during the decryption of Cryptographic Message Syntax CMS AuthEnvelopedData. The software fails to properly enforce the tag-length, which could enable an attacker to...
Heap Buffer Overflow in CMS Key Unwrapping
...
PT-2026-82558
Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description The Twig sandbox mechanism is configured to allow dangerous functionality from the Yii framework. This configuration allows authenticated users to achieve Remote Code Execution RCE, which i...
CVE-2026-75419
go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...
CVE-2026-75419
go-wind-cms (GoWind) before 1.0.0 suffers from a missing authorization flaw. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), causing the authz middleware to always allow requests...
CVE-2026-39275
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...
