16007 matches found
aldryn-django-cms (3.5.3.2), aldryn-events (>=1.1.1, <=2.0.0) +79 more potentially affected by CVE-2026-54624 via django-cms (>=3.1.7, <=5.0.6)
django-cms PYPI version =3.1.7, =1.1.1, =1.0.13, =3.0.4, =1.1.1, =1.0.7, =0.2.0, =0.1.1, =1.3.0, =0.1.0, =0.2.0 - cmsplugin-feed-ai 0.0.1 - cmsplugin-google-maps-ai 0.0.1 - cmsplugin-markdownx 0.1.2 and more Source cves: CVE-2026-54624 Source advisory: MEND:CVE-2026-54624...
CVE-2026-54624
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...
CVE-2026-54624
In django CMS before 5.0.8, the structure endpoint in cms/views.py renders structure.html without calling user_can_view_page(), unlike edit/preview endpoints. A low-privileged staff user can read restricted pages' plugin short descriptions (link names, URLs, snippets) when CMS_PERMISSION=True and...
CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...
EUVD-2026-63567
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...
CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...
CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...
aldryn-django-cms (3.5.3.2), aldryn-events (>=1.1.1, <=2.0.0) +79 more potentially affected by CVE-2026-54623 via django-cms (>=3.1.7, <=5.0.6)
django-cms PYPI version =3.1.7, =1.1.1, =1.0.13, =3.0.4, =1.1.1, =1.0.7, =0.2.0, =0.1.1, =1.3.0, =0.1.0, =0.2.0 - cmsplugin-feed-ai 0.0.1 - cmsplugin-google-maps-ai 0.0.1 - cmsplugin-markdownx 0.1.2 and more Source cves: CVE-2026-54623 Source advisory: MEND:CVE-2026-54623...
CVE-2026-54623
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...
CVE-2026-54623
django CMS prior to 5.0.8 is vulnerable to a denial-of-service via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier, allowing a staff user with plugin-c...
CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...
CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...
CVE-2026-54625
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...
aldryn-django-cms (3.5.3.2), aldryn-events (>=1.1.1, <=2.0.0) +79 more potentially affected by CVE-2026-54625 via django-cms (>=3.1.7, <=5.0.6)
django-cms PYPI version =3.1.7, =1.1.1, =1.0.13, =3.0.4, =1.1.1, =1.0.7, =0.2.0, =0.1.1, =1.3.0, =0.1.0, =0.2.0 - cmsplugin-feed-ai 0.0.1 - cmsplugin-google-maps-ai 0.0.1 - cmsplugin-markdownx 0.1.2 and more Source cves: CVE-2026-54625 Source advisory: MEND:CVE-2026-54625...
CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...
CVE-2026-54625
django CMS prior to 5.0.8 and in 5.1.0a1 contains a page cache vulnerability in cms/cache/page.py. The _page_cache_key function omits request header values declared by plugins through get_vary_cache_on() from the cache key, even though set_page_cache correctly adds those header names to the respo...
CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...
CLSA-2026-1787225546 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post11+tuxcare...