CVE-2026-54625

django CMS prior to 5.0.8 and in 5.1.0a1 contains a page cache vulnerability in cms/cache/page.py. The _page_cache_key function omits request header values declared by plugins through get_vary_cache_on() from the cache key, even though set_page_cache correctly adds those header names to the respo...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CLSA-2026-1787225546 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post11+tuxcare...

CLSA-2026-1787224698 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.2.post7+tuxcare...

CLSA-2026-1787220902 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post10+tuxcare...

CLSA-2026-1787220072 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post6+tuxcare...

PatrowlManager v1.8.4

Codacy Badge PatrOwl PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations. PatrowlManager is the Front-end application for managing the assets, reviewing risks on real-time, orchestrating the operations scans, searches, API calls, ..., aggregating the results...

CVE-2026-54625: Acceptance of Extraneous Untrusted Data With Trusted Data

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-54622: Authorization Bypass Through User-Controlled Key

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

CVE-2026-63003: Authorization Bypass Through User-Controlled Key

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor...

PT-2026-79093

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 django CMS version 5.1.0a1 Description The page cache in cms/cache/page.py ignores request headers declared by plugins through the get vary cache on function. While the page cache key function includes the...

PT-2026-79095

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description Page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde...

CVE-2026-54624: Improper Authorization

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-61663: Authorization Bypass Through User-Controlled Key

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...

CVE-2026-75526: Improper Neutralization of Input During Web Page Generation

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

PT-2026-79094

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description The render object structure function fails to properly authorize non-PageContent objects that utilize PlaceholderRelationField. An active staff user lacking cms.use structure or model-level view o...

PT-2026-79101

Name of the Vulnerable Software and Affected Versions django CMS versions 5.0.8 through 5.0.8 Description In edit mode, the ContentRenderer.render placeholder function in cms/plugin rendering.py can pass stored, attacker-controlled values to the ContentRenderer.render exception function when plug...

PT-2026-80240

Impact The only authorization gate on the duplicate flow is PageAdmin.has add permission, which checks user can add pageuser, site / user can add subpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

PT-2026-79092

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The render object structure function in cms/views.py renders cms/toolbar/structure.html for a PageContent object without verifying permissions via the user can view page function. When CMS...

PT-2026-79091

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...