aldryn-forms (>=3.0.4, <=3.0.5), django-cms-qe (>=2.0.0, <=2.2.0) +5 more potentially affected by CVE-2026-54622 via django-cms (3.7.4)

django-cms PYPI version 3.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-forms =3.0.4, =2.0.0, =0.1.0, =0.1.0, =0.2.4 - taccsite-cms 3.6.0a0 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...

aldryn-forms (>=3.0.4, <=3.0.5), django-cms-qe (>=2.0.0, <=2.2.0) +5 more potentially affected by CVE-2026-54624 via django-cms (3.7.4)

django-cms PYPI version 3.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-forms =3.0.4, =2.0.0, =0.1.0, =0.1.0, =0.2.4 - taccsite-cms 3.6.0a0 Source cves: CVE-2026-54624 Source advisory: OSV:PYSEC-2026-3826...

richie (2.15.1) potentially affected by CVE-2026-54624 via django-cms (3.11.0)

django-cms PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie 2.15.1 Source cves: CVE-2026-54624 Source advisory: OSV:PYSEC-2026-3826...

django-shop (1.2.4), djangocms-algolia (>=0.1.0.0, <=1.3.2.0) +8 more potentially affected by CVE-2026-54622 via django-cms (3.11.3)

django-cms PYPI version 3.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-shop 1.2.4 - djangocms-algolia =0.1.0.0, =1.0.0, =1.0.0, =0.2.0.0, =0.0.0.1, =1.0.0.0 - djangoshop-gestpay 0.1.0 - djangoshop-wspay...

django-cms-helpers (3.0.0), djangocms-aldryn-forms (>=8.0.0, <=8.2.0) +10 more potentially affected by CVE-2026-54622 via django-cms (4.1.11)

django-cms PYPI version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-helpers 3.0.0 - djangocms-aldryn-forms =8.0.0, =4.0.0, =3.0.0, =2.0.0, =2.0.0, =0.2.2, =0.5.0, =1.1.4, =1.1.8 Source cves:...

django-cms-helpers (3.0.0), djangocms-aldryn-forms (>=8.0.0, <=8.2.0) +10 more potentially affected by CVE-2026-54624 via django-cms (4.1.11)

django-cms PYPI version 4.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-helpers 3.0.0 - djangocms-aldryn-forms =8.0.0, =4.0.0, =3.0.0, =2.0.0, =2.0.0, =0.2.2, =0.5.0, =1.1.4, =1.1.8 Source cves:...

django-unfold-extra (>=0.1.1, <=0.1.2), djangocms-haystack (>=0.5.0, <=0.5.1) potentially affected by CVE-2026-54624 via django-cms (>=5.0.0a1, <=5.0.6)

django-cms PYPI version =5.0.0a1, =0.1.1, =0.5.0, =0.5.1 Source cves: CVE-2026-54624 Source advisory: OSV:PYSEC-2026-3826...

aldryn-faq (1.0.13), aldryn-people (1.1.1) +1 more potentially affected by CVE-2026-54624 via django-cms (3.2.5)

django-cms PYPI version 3.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-faq 1.0.13 - aldryn-people 1.1.1 - aldryn-snippet 0.1.4.2 Source cves: CVE-2026-54624 Source advisory: OSV:PYSEC-2026-3826...

djangocms-highlightjs (0.4.0), djangocms-lab-publications (0.1.4) potentially affected by CVE-2026-54624 via django-cms (3.3.1)

django-cms PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-highlightjs 0.4.0 - djangocms-lab-publications 0.1.4 Source cves: CVE-2026-54624 Source advisory: OSV:PYSEC-2026-3826...

aldryn-events (>=1.1.1, <=1.1.3), aldryn-faq (1.2.1) +4 more potentially affected by CVE-2026-54622 via django-cms (3.3.4)

django-cms PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events =1.1.1, =1.1.3 - aldryn-faq 1.2.1 - aldryn-people 1.2.1 - cmsplugin-articles-ai 0.1.1 - cmsplugin-carousel-ai 0.0.3 -...

aldryn-events (>=1.1.1, <=1.1.3), aldryn-faq (1.2.1) +4 more potentially affected by CVE-2026-54624 via django-cms (3.3.4)

django-cms PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events =1.1.1, =1.1.3 - aldryn-faq 1.2.1 - aldryn-people 1.2.1 - cmsplugin-articles-ai 0.1.1 - cmsplugin-carousel-ai 0.0.3 -...

djangocms-htmlsitemap (0.5.0), leprikon (>=2.28.1, <=2.39.2) potentially affected by CVE-2026-54622 via django-cms (3.6.1)

django-cms PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-htmlsitemap 0.5.0 - leprikon =2.28.1, =2.39.2 Source cves: CVE-2026-54622 Source advisory: OSV:PYSEC-2026-3820...

djangocms-htmlsitemap (0.5.0), leprikon (>=2.28.1, <=2.39.2) potentially affected by CVE-2026-54624 via django-cms (3.6.1)

django-cms PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-htmlsitemap 0.5.0 - leprikon =2.28.1, =2.39.2 Source cves: CVE-2026-54624 Source advisory: OSV:PYSEC-2026-3826...

django CMS: Stored XSS in edit-mode plugin exception rendering

SummaryWhen plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's short...

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

SummaryThe django-cms frontend-editing structure endpointGET //admin/cms/placeholder/object//structure//did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a model...

PYSEC-2026-3826 django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

PYSEC-2026-3820 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-76217 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-76217 Source advisory: OSV:PYSEC-2026-3841...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-76220 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-76220 Source advisory: OSV:PYSEC-2026-3843...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2026-76218 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2026-76218 Source advisory: OSV:PYSEC-2026-3840...