djangocms-plugie (0.1.4) potentially affected by CVE-2026-63003 via django-cms (3.7.0rc2)

django-cms PYPI version 3.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-plugie 0.1.4 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

djangocms-htmlsitemap (0.5.0), leprikon (>=2.28.1, <=2.39.2) potentially affected by CVE-2026-63003 via django-cms (3.6.1)

django-cms PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-htmlsitemap 0.5.0 - leprikon =2.28.1, =2.39.2 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

richie (>=1.0.0b0, <=1.0.0b3) potentially affected by CVE-2026-63003 via django-cms (3.6.0)

django-cms PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie =1.0.0b0, =1.0.0b3 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

aldryn-events (2.0.0), aldryn-people (2.0.0) +7 more potentially affected by CVE-2026-63003 via django-cms (3.5.4)

django-cms PYPI version 3.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events 2.0.0 - aldryn-people 2.0.0 - aldryn-reversion =1.0.7, =0.2.0, =0.6.2, =0.3.0, =0.3.5 - emencia-contact-form 0.3.0 Source cves...

aldryn-django-cms (3.5.3.2), django-shopit (0.5.2) potentially affected by CVE-2026-63003 via django-cms (3.5.3)

django-cms PYPI version 3.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-django-cms 3.5.3.2 - django-shopit 0.5.2 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

cmsplugin-articles-ai (>=0.1.2, <=0.2.4), cmsplugin-google-maps-ai (0.0.1) +3 more potentially affected by CVE-2026-63003 via django-cms (3.4.7)

django-cms PYPI version 3.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-articles-ai =0.1.2, =0.0.3, =0.4.0 - djangocms-htmlsitemap 0.3.1 - djangocms-slick-slider 0.6.0 Source cves: CVE-2026-63003 Source...

cmsplugin-markdownx (0.1.2) potentially affected by CVE-2026-63003 via django-cms (3.4.2)

django-cms PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-markdownx 0.1.2 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

aldryn-events (>=1.1.1, <=1.1.3), aldryn-faq (1.2.1) +4 more potentially affected by CVE-2026-63003 via django-cms (3.3.4)

django-cms PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events =1.1.1, =1.1.3 - aldryn-faq 1.2.1 - aldryn-people 1.2.1 - cmsplugin-articles-ai 0.1.1 - cmsplugin-carousel-ai 0.0.3 -...

djangocms-highlightjs (0.4.0), djangocms-lab-publications (0.1.4) potentially affected by CVE-2026-63003 via django-cms (3.3.1)

django-cms PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-highlightjs 0.4.0 - djangocms-lab-publications 0.1.4 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

aldryn-faq (1.0.13), aldryn-people (1.1.1) +1 more potentially affected by CVE-2026-63003 via django-cms (3.2.5)

django-cms PYPI version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-faq 1.0.13 - aldryn-people 1.1.1 - aldryn-snippet 0.1.4.2 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

django-unfold-extra (>=0.1.1, <=0.1.2), djangocms-haystack (>=0.5.0, <=0.5.1) potentially affected by CVE-2026-63003 via django-cms (>=5.0.0a1, <=5.0.6)

django-cms PYPI version =5.0.0a1, =0.1.1, =0.5.0, =0.5.1 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

django-cms-helpers (3.0.0), djangocms-aldryn-forms (>=8.0.0, <=8.2.0) +10 more potentially affected by CVE-2026-63003 via django-cms (4.1.11)

django-cms PYPI version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-helpers 3.0.0 - djangocms-aldryn-forms =8.0.0, =4.0.0, =3.0.0, =2.0.0, =2.0.0, =0.2.2, =0.5.0, =1.1.4, =1.1.8 Source cves:...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-63003 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the DuplicatePageForm.cleansource bypass in cms/admin/forms.py. The source field in DuplicatePageForm is a hidden field whose value is fully controlled by the client on POST, and its queryset spans every page o...

richie (2.15.1) potentially affected by CVE-2026-63003 via django-cms (3.11.0)

django-cms PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie 2.15.1 Source cves: CVE-2026-63003 Source advisory: OSV:GHSA-6X92-6VX4-5FWR...

GHSA-6X92-6VX4-5FWR django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

Impact The only authorization gate on the duplicate flow is PageAdmin.hasaddpermission, which checks usercanaddpageuser, site / usercanaddsubpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

GHSA-HVQ6-2R72-P2X7 django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

aldryn-events (>=1.1.1, <=1.1.3), aldryn-faq (1.2.1) +4 more potentially affected by CVE-2026-54624 via django-cms (3.3.4)

django-cms PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events =1.1.1, =1.1.3 - aldryn-faq 1.2.1 - aldryn-people 1.2.1 - cmsplugin-articles-ai 0.1.1 - cmsplugin-carousel-ai 0.0.3 -...

djangocms-plugie (0.1.4) potentially affected by CVE-2026-54624 via django-cms (3.7.0rc2)

django-cms PYPI version 3.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-plugie 0.1.4 Source cves: CVE-2026-54624 Source advisory: OSV:GHSA-VGXM-H9GX-H9W7...