CVE-2026-119646

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

EUVD-2026-114062

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

CVE-2026-119646 Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

CVE-2026-119646: Open Web Analytics: Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other…

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

PT-2026-133576

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view reports on one site can supply that siteId with another...

CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

CVE-2026-112776: Incorrect Authorization

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries,...

Craft CMS authorization issue vulnerability

Craft CMS versions 5.0.0 to 5.11.0 have an authorization vulnerability. This vulnerability stems from an, as the requireAllowedSite check is not enforced. As a result, attackers with a GraphQL token from site A can create entries on site B using the provided siteId, and can delete items,...

CVE-2026-79991

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79990

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-84796

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-84796

Craft CMS versions from 5.0.0-RC1 through 5.10.10 are affected by a site scope bypass in its GraphQL entry mutation resolvers . The root cause is a failure to validate the siteId argument through ArgumentManager::prepareArguments() , allowing an attacker holding a token scoped to one site to read...

CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-79990: Authorization Bypass Through User-Controlled Key

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-84796: Authorization Bypass Through User-Controlled Key

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-79991: Improper Neutralization of Special Elements used in an SQL Command

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

PT-2026-84669

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration server/analytics/matomo-analytics.js injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary...

PT-2026-68158

Name of the Vulnerable Software and Affected Versions Uptime Kuma affected versions not specified Description The Matomo analytics integration in the server/analytics/matomo-analytics.js file allows the injection of the admin-configurable siteId value as an unquoted JavaScript expression within a...

CVE-2026-8943 GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function

The GoStats for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the gostatsmanage function. This makes it possible for unauthenticated attackers to update the plugin's...