Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
884 results · page 5 of 18
Jul 2, 2026Craft CMS is a content management system (CMS).CVE-2026-50282 · Other software · craftcms · reported by GitHubMedium 4.9
Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Craft CMS is a content management system (CMS).CVE-2026-50281 · Other software · craftcms · reported by GitHubHigh 7.1
Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes the attacker's attributes into the victim's existing entry row. ElementsController::beforeAction() pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level, actionBulkDuplicate(), reads a separate newAttributes array and passes it straight through to the service layer. Elements::duplicateElement() clones the source element, sets id to null, and then hands the attacker's array to Craft::configure(), which overwrites the reset id with any numeric value inside $newAttributes. PHP Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. The attackers's title, slug, authorId, postDate, and UID land on the victim's entry. safeAttributes() on Entry includes id because the base element model exposes it, so the C
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-55794 · Other software · craftcms · reported by GitHubHigh 8.7
Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control. This issue has been fixed in version 5.10.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-55792 · Other software · craftcms · reported by GitHubMedium 6
Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-55791 · Other software · craftcms · reported by GitHubMedium 6.9
Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header. The vulnerability manifests when assetManager.cacheSourcePaths is set to false. This issue has been fixed in versions 4.18.0 and 5.10.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-50280 · Other software · craftcms · reported by GitHubMedium 6
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-50279 · Other software · craftcms · reported by GitHubHigh 7.6
Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission. This issue has been fixed in version 5.9.21.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-55790 · Other software · craftcms · reported by GitHubHigh 7.4
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-50284 · Other software · craftcms · reported by GitHubHigh 7.1
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-50283 · Other software · craftcms · reported by GitHubMedium 5.3
Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads: assetId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume. When both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no deletion check for for the source asset. An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId, leading to broken content references and data loss. This issue has been fixed in versions 4.17.14 and 5.9.21.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Craft CMS is a content management system (CMS).CVE-2026-55793 · Other software · craftcms · reported by GitHubMedium 5.9
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session. The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping. To exploit, an attacker must have an existing control panel account (Author role minimum), the victim must perform a drag operation (not just visit the page), and the victim’s session needs to be elevated at trigger time. This issue has been fixed in version 5.9.23.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54263 · Other software · wagtail · reported by GitHubHigh 7.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54262 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54261 · Other software · wagtail · reported by GitHubMedium 6.5
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54260 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54259 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Tina is a headless content management system.CVE-2026-55661 · Other software · tinacms · reported by GitHubMedium 4.8
Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and executes when the content is viewed. Any actor able to author rich-text content (for example a lower-privileged editor, or imported/external content) can achieve stored XSS against editors and site viewers. This issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Tina is a headless content management system.CVE-2026-55660 · Other software · tinacms · reported by GitHubHigh 7.6
Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on event.data without verifying event.origin or event.source and post messages using non-specific target origins, while insufficient URL sanitization in rich-text content allows malicious URLs to persist and execute. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session. This issue has been fixed in versions @tinacms/app 2.5.6 and tinacms 3.9.3.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Tina is a headless content management system.CVE-2026-54074 · Other software · tinacms · reported by GitHubHigh 7.8
Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53949 · Other software · TryGhost · reported by GitHubMedium 5.3
Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes' case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53948 · Other software · TryGhost · reported by GitHubMedium 5.4
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53947 · Other software · TryGhost · reported by GitHubMedium 5.3
Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53946 · Other software · TryGhost · reported by GitHubMedium 5.4
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card at an attacker-chosen host and cause the Ghost server to request it on their behalf, including hosts on internal networks or cloud instance metadata endpoints that would not normally be reachable from the public internet. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53945 · Other software · TryGhost · reported by GitHubMedium 4
Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53944 · Other software · TryGhost · reported by GitHubMedium 5.8
Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. This vulnerability is fixed in 6.21.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2026Ghost is a Node.js content management system.CVE-2026-53943 · Other software · TryGhost · reported by GitHubCritical 9.6
Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output. When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure. This vulnerability is fixed in 6.37.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026Statamic is a Laravel and Git powered content management system (CMS).CVE-2026-49288 · Other software · statamic · reported by GitHubMedium 4.3
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2026Statamic is a Laravel and Git powered content management system (CMS).CVE-2026-49287 · Other software · statamic · reported by GitHubHigh 7.4
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets. This requires a front-end template that passes request input into a tag's sort parameter. It is not exploitable by default — a template would need to be explicitly set up to sort by a visitor-controlled value. This has been fixed in 5.73.23 and 6.20.0.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026e107 is a content management system (CMS).CVE-2026-48997 · Other software · e107inc · reported by GitHubHigh 7.1
e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6.
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-53609 · Other software · apostrophecms · reported by GitHubCritical 9.1
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type REST API endpoints for every subsequent unauthenticated request, for the lifetime of the Node.js process. As of time of publication, no known patched versions are available.
- Product
- apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-53608 · Other software · apostrophecms · reported by GitHubHigh 8.7
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directly into `<script>` tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access (the default role for content managers) can set these fields to a malicious value, resulting in stored XSS that executes on every page for every visitor of the site. As of time of publication, no known patched versions are available.
- Product
- @apostrophecms/seo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-53607 · Other software · apostrophecms · reported by GitHubLow 3.7
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header. That URL is then `fetch`'ed and the response body + headers are streamed straight back to the requester. Because `Host` is fully attacker-controlled, an unauthenticated remote attacker can pivot the apostrophe process to issue outbound HTTP requests against any host it can reach on the private network. The path component is constrained to `/uploads/attachments/<cuid>-<slug>.<ext>` (built from a local-DB lookup), which keeps the impact narrow: cross-instance data exfiltration is neutralized by cuid uniqueness, but blind-SSRF residuals remain (network-topology mapping via response-code / timing differences and verbose proxy/WAF 404 body disclosure). As of time of publication, no known patched versions exist.
- Product
- apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.CVE-2026-53606 · Other software · apostrophecms · reported by GitHubMedium 5.4
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 use `allowedSchemesAppliedToAttributes` (default: `['href', 'src', 'cite']`) to gate the `naughtyHref()` function that blocks dangerous URI schemes like `javascript:` and `vbscript:`. The HTML specification defines 10+ attributes that accept URIs (`action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, `lowsrc`), but none of these are included in the default gate list. When a developer allows any of these attributes in their configuration, `javascript:` URIs pass through completely unmodified, enabling XSS. Version 2.17.5 patches the issue.
- Product
- sanitize-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-45014 · Other software · apostrophecms · reported by GitHubMedium 5.3
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no known patched versions are available.
- Product
- apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-45013 · Other software · apostrophecms · reported by GitHubHigh 8.1
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted reset request that causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid reset token is delivered to the attacker, enabling full account takeover. As of time of publication, no known patched versions are available.
- Product
- apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-45012 · Other software · apostrophecms · reported by GitHubHigh 7.6
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. As of time of publication, no known patched versions are available.
- Product
- apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-45011 · Other software · apostrophecms · reported by GitHubHigh 7.3
ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/link, arbitrary JavaScript executes in the victim’s browser. As of time of publication, no known patched versions are available.
- Product
- apostrophe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.CVE-2026-44990 · Other software · apostrophecms · reported by GitHubCritical 9.3
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.
- Product
- sanitize-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Jun 12, 2026ApostropheCMS is an open-source Node.js content management system.CVE-2026-42853 · Other software · apostrophecms · reported by GitHubMedium 6.5
ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping. This allows execution of arbitrary commands on the host system. As of time of publication, no known patched versions are available.
- Product
- @apostrophecms/cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Xibo is an open source digital signage platform with a web content management system and Windows display player software.CVE-2026-42558 · Other software · xibosignage · reported by GitHubHigh 7.6
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include "Add DataSet" button to allow for additional DataSets to be created independently to Layouts Users should upgrade to version 4.4.2 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.
- Product
- xibo-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Sharp is a content management framework built for Laravel as a package.CVE-2026-53634 · Other software · code16 · reported by GitHubMedium 4.3
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.
- Product
- sharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Sharp is a content management framework built for Laravel as a package.CVE-2026-44692 · Other software · code16 · reported by GitHubHigh 7.7
Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. This issue has been patched in version 9.22.0.
- Product
- sharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026Bludit is a content management system.CVE-2026-46657 · Other software · bludit · reported by GitHubHigh 7.1
Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.
- Product
- bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026Bludit is a content management system.CVE-2026-46656 · Other software · bludit · reported by GitHubHigh 8.8
Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.
- Product
- bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Sulu is an open-source PHP content management system based on the Symfony framework.CVE-2026-45701 · Other software · sulu · reported by GitHubMedium 6.9
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key generation uses a weak cryptographical hash algorithm. This issue has been patched in versions 2.6.23 and 3.0.6.
- Product
- sulu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Statamic is a Laravel and Git powered content management system (CMS).CVE-2026-45660 · Other software · statamic · reported by GitHubMedium 5.4
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Automad is a flat-file content management system and template engine.CVE-2026-45332 · Other software · marcantondahmen · reported by GitHubHigh 7.5
Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The /_api/user-collection/create-first-user setup endpoint remains publicly accessible once initial configuration is complete and returns full serialized user data in the JSON response body. This vulnerability is fixed in 2.0.0-beta.28.
- Product
- automad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026e107 is a content management system (CMS).CVE-2026-46620 · Other software · e107inc · reported by GitHubMedium 6.5
e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026e107 is a content management system (CMS).CVE-2026-43936 · Other software · e107inc · reported by GitHubMedium 4.3
e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File URL:" of "From a remote location" in "Media Manager" on the administrator screen. This vulnerability is fixed in 2.3.4.
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026e107 is a content management system (CMS).CVE-2026-43935 · Other software · e107inc · reported by GitHubHigh 8.1
e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4.
- Product
- e107
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.