WordPress Content Visibility for Divi Builder plugin <= 5.03 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by ParkHyunWoo in WordPress Plugin Content Visibility for Divi Builder versions = 5.03...

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

django CMS: Structure endpoint bypasses page-view permission

SummaryThe structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff user...

PYSEC-2026-3820 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

EUVD-2026-63568

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

CVE-2026-13314 Stored XSS in pretix-digital

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +93 more potentially affected by CVE-2026-22599 via @strapi/plugin-content-type-builder (>=4.0.0, <=4.26.0)

@strapi/plugin-content-type-builder NPM version =4.0.0, =0.1.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2026-22599 Source advisory: MEND:CVE-2026-22599...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +93 more potentially affected by CVE-2026-22599 via @strapi/plugin-content-type-builder (>=4.0.0, <=4.26.0)

@strapi/plugin-content-type-builder NPM version =4.0.0, =0.1.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2026-22599 Source advisory: GHSA-3XCQ-8MJW-H6MX...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +93 more potentially affected by CVE-2026-22599 via @strapi/plugin-content-type-builder (>=4.0.0-next.10, <=4.26.0)

@strapi/plugin-content-type-builder NPM version =4.0.0-next.10, =0.1.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2026-22599 Source advisory: SNYK:JS-STRAPIPLUGINCONTENTTYPEBUILDER-16686875...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (>=0.1.0, <=0.1.1) +93 more potentially affected by CVE-2026-22599 via @strapi/plugin-content-type-builder (>=4.0.0, <=4.26.0)

@strapi/plugin-content-type-builder NPM version =4.0.0, =0.1.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2026-22599 Source advisory: OSV:GHSA-3XCQ-8MJW-H6MX...

EUVD-2013-5434

Malware in sbrugna...

GHSA-QF34-QPR4-5PPH docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

GitHub Personal Access Token Exposure in docusaurus-plugin-content-gists Summary docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for...

CVE-2025-53624: Exposure of Sensitive Information to an Unauthorized Actor

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

CVE-2013-5594

Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-content-manager NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: OSV:GHSA-6J89-FRXC-Q26M...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=4.0.0-beta.0, <=4.19.0)

@strapi/plugin-content-manager NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: GHSA-6J89-FRXC-Q26M...

CVE-2024-29181

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +80 more potentially affected by CVE-2024-29181 via @strapi/plugin-content-manager (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.19.0)

@strapi/plugin-content-manager NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.2.3 and more Source cves: CVE-2024-29181 Source advisory: MEND:CVE-2024-29181...

CVE-2024-29181: Authorization Bypass Through User-Controlled Key

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +52 more potentially affected by CVE-2023-37263 via @strapi/plugin-content-manager (>=0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, <=4.12.0)

@strapi/plugin-content-manager NPM version =0.0.0-a3d182e0454ccff2702450b31621cd5026b389ca, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-37263 Source advisory: MEND:CVE-2023-37263...