CVE-2026-57518 Pagekit CMS 1.0.18 Privilege Escalation via UserApiController

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction. Attackers can...

CVE-2026-57518

Pagekit CMS 1.0.18 contains a privilege escalation flaw in UserApiController::saveAction(). Authenticated users with the 'user: manage users' permission can assign arbitrary custom roles to themselves, including roles with 'system: manage packages' permission, enabling them to upload and install ...

EUVD-2025-210355

Unauthenticated Content Injection in Auros Core = 5.3.1 versions...

CVE-2026-57648

Contributor Broken Access Control in Nelio Content = 4.3.4 versions...

CVE-2025-64637

Unauthenticated Content Injection in Auros Core = 5.3.1 versions...

CVE-2026-57648 WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability

Contributor Broken Access Control in Nelio Content = 4.3.4 versions...

CVE-2026-57648

Contributor Broken Access Control in Nelio Content = 4.3.4 versions...

EUVD-2026-39763

Contributor Broken Access Control in Nelio Content = 4.3.4 versions...

CVE-2026-57648

Technical details about CVE-2026-57648 are not publicly available in the provided documents. Monitor for updates from references for affected versions, impact, and remediation.

EUVD-2026-39733

Contributor Arbitrary File Deletion in H5P = 1.17.7 versions...

CVE-2025-64637 WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability

Unauthenticated Content Injection in Auros Core = 5.3.1 versions...

CVE-2025-64637

CVE-2025-64637 concerns the WordPress plugin Auros Core (versions

WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability

Content Injection vulnerability discovered by Bonds in WordPress Plugin Auros Core versions = 5.3.1...

WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Averon Averenkov in WordPress Plugin Nelio Content versions = 4.3.4...

MAL-2026-6499 Malicious code in mongoose-json-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910cc6eef707ac872daeb3a527e6dd9c75044ebb178f9eb48745f5cfd4123968 helpers.js defines a createLog helper that base64-decodes a constant HASHKEY to https://www.jsonkeeper.com/b/XVHGD an anonymous JSON-paste host and...

SUSE CVE-2026-53002

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in manglecontentlen while at it...

SUSE CVE-2026-53149

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size tbpropertyparsedir does not check that contentoffset + contentlen fits within blocklen for the root directory case. When rootdir-length equals or exceeds blocklen - 2, the...

EUVD-2026-39594

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...

CVE-2026-13218

A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...

PT-2026-53029

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.0 Statamic versions prior to 6.20.3 Description The Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only verifies view authorization but accepts and renders...