CVE-2026-104051

PictShare versions prior to 3.7.1 are vulnerable to an information disclosure vulnerability via the API::info() endpoint. The root cause is the lack of a field whitelist, allowing unauthenticated attackers to retrieve complete raw metadata objects. By using a publicly visible file hash, an attack...

PT-2026-68967

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

CVE-2026-49287: Use of Externally-Controlled Input to Select Classes or Code

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could...

PT-2026-35295

Impact Manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of content, assets, and user accounts. The Control Panel requires authentication with minimal permissions in order to exploit. e.g. "view entries" permission to...