@gluuten/gluuten-cli (0.9.5), @open-xchange/vite-plugin-i18next-gettext (>=0.0.1, <=0.0.4) +2 more potentially affected by CVE-2026-55451 via gettext-converter (>=1.0.3, <=1.3.2)

gettext-converter NPM version =1.0.3, =0.0.1, =7.1.0, =4.11.2, =4.18.0 Source cves: CVE-2026-55451 Source advisory: OSV:GHSA-F4JP-RW7W-CCWG...

CVE-2026-54624

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

UBUNTU-CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderexception process. An attacker can execute arbitrary scripts in the context of a staff user's browser by injecting malicious HTML into plugin fields that are later rendered during edit mode exceptio...

django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

GHSA-HVQ6-2R72-P2X7 django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

GHSA-P853-83GJ-WJJ3 NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

EUVD-2026-63534

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl contain a caching issue in the _serve_static method, which always sets the Cache-Control header to "public" with no means of overriding it. This advises proxies that content may be stored in a shared cache and reused in responses to ...

CVE-2026-15743 Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

EUVD-2026-63571

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

CVE-2026-75526 django CMS: Stored XSS in edit-mode plugin exception rendering

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.renderplaceholder in cms/pluginrendering.py can pass stored, attacker-controlled values to ContentRenderer.renderexception when plugin rendering fail...

RLSA-2026:56007 Important: mysql8.4 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fixes: mysql:...

mysql8.4 security, bug fix, and enhancement update

An update is available for mysql8.4. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MySQL is a multi-user, multi-threaded SQL database server. MySQL is a...

EUVD-2026-63568

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

CVE-2026-54622

django CMS prior to 5.0.8 contains an IDOR in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py). The _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard paths validate only the destination clipboard but never perform source-side authorization on the attacker-supplied source...

CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...