Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
884 results · page 9 of 18
Feb 23, 2026Craft is a content management system (CMS).CVE-2026-27129 · Other software · craftcms · reported by GitHubMedium 5.7
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Craft is a content management system (CMS).CVE-2026-27128 · Other software · craftcms · reported by GitHubMedium 6.9
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The `getTokenRoute()` method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. Versions 4.16.19 and 5.8.23 patch the issue.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Craft is a content management system (CMS).CVE-2026-27127 · Other software · craftcms · reported by GitHubHigh 7
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Craft is a content management system (CMS).CVE-2026-27126 · Other software · craftcms · reported by GitHubMedium 5.9
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Formwork is a flat file-based Content Management System (CMS).CVE-2026-27198 · Other software · getformwork · reported by GitHubHigh 8.8
Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.
- Product
- formwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2026Statmatic is a Laravel and Git powered content management system (CMS).CVE-2026-27196 · Other software · statamic · reported by GitHubHigh 8.1
Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This issue has been fixed in 6.3.2 and 5.73.9.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27202 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.8
GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. This issue has not been fixed at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27161 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.7
GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27147 · Other software · GetSimpleCMS-CE · reported by GitHubMedium 6.9
GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG files via the administrative upload functionality, but they are not properly sanitized or restricted, allowing an attacker to embed malicious JavaScript. When the uploaded SVG file is accessed, the script executes in the browser. This issue does not have a fix at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27146 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.1
GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a result, an attacker can craft a malicious web page that silently triggers a file upload request from an authenticated victim’s browser. The request is accepted without requiring a CSRF token or origin validation. This allows an attacker to upload arbitrary files to the application without the victim’s knowledge or consent. In order to exploit this vulnerability, the victim must be authenticated to GetSimple CMS (e.g., admin user), and visit an attacker-controlled webpage. This issue does not have a fix at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Ghost is a Node.js content management system.CVE-2026-26980 · Other software · TryGhost · reported by GitHubCritical 9.4
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Statmatic is a Laravel and Git powered content management system (CMS).CVE-2026-25759 · Other software · statamic · reported by GitHubHigh 8.7
Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. Malicious user must have an account with control panel access and content creation permissions. This vulnerability can be exploited to allow super admin accounts to be created. This has been fixed in 6.2.3.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crCVE-2026-0485 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, rendering the CMS completely unavailable. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
- Product
- SAP BusinessObjects BI Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Craft CMS is a content management system.CVE-2026-25492 · Other software · craftcms · reported by GitHubMedium 5.3
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a non-image file extension such as .txt is allowed, downstream image validation is bypassed, which can allow an authenticated attacker with permission to use save_images_Asset to retrieve sensitive data such as AWS instance metadata credentials from the underlying host. This issue is patched in versions 4.16.18 and 5.8.22.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Payload is a free and open source headless content management system.CVE-2026-25574 · Other software · payloadcms · reported by GitHubMedium 5.4
Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Payload is a free and open source headless content management system.CVE-2026-25544 · Other software · payloadcms · reported by GitHubCritical 9.8
Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data (emails, password reset tokens) and achieve full account takeover without password cracking. This vulnerability is fixed in 3.73.0.
- Product
- payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.CVE-2026-22254 · Other software · wintercms · reported by GitHubNone
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.
- Product
- winter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Wagtail is an open source content management system built on Django.CVE-2026-25517 · Other software · wagtail · reported by GitHubMedium 5.1
Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Umbraco Forms is a form builder that integrates with the Umbraco content management system.CVE-2026-24687 · Other software · umbraco · reported by GitHubMedium 6
Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended.
- Product
- Umbraco.Forms.Issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc.CVE-2025-7714 · Other software · Global Interactive Design Media Software Inc. · reported by iletisim@usom.gov.trHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection. This issue affects Content Management System (CMS): through 21072025.
- Product
- Content Management System (CMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 29, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc.CVE-2025-7713 · Other software · Global Interactive Design Media Software Inc. · reported by iletisim@usom.gov.trHigh 7.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows XSS Through HTTP Headers. This issue affects Content Management System (CMS): through 21072025.
- Product
- Content Management System (CMS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24838 · Other software · dnnsoftware · reported by GitHubCritical 9.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24837 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during some module operations in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24836 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include scripts that would run in the PersonaBar when displayed. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24833 · Other software · dnnsoftware · reported by GitHubHigh 7.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will run for user in the Persona Bar. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2026-24784 · Other software · dnnsoftware · reported by GitHubMedium 6.8
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026StudioCMS is a server-side-rendered, Astro native, headless content management system.CVE-2026-24134 · Other software · withstudiocms · reported by GitHubMedium 6.5
StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by Editor/Admin/Owner users. Version 0.2.0 patches the issue.
- Product
- studiocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Ghost is an open source content management system.CVE-2026-24778 · Other software · TryGhost · reported by GitHubHigh 8.8
Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0 were vulnerable to this issue. Ghost automatically loads the latest patch of the members Portal component via CDN. For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability. v5.121.0 loads Portal v2.51.5, which contains the patch. For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability. v6.15.0 loads Portal v2.57.1, which contains the patch. For Ghost installations using a customized or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2026Squidex is an open source headless content management system and content management hub.CVE-2026-24736 · Other software · Squidex · reported by GitHubCritical 9.1
Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as actions within the Rules engine. The url parameter in the webhook configuration does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a "Blind" SSRF into a "Full Read" SSRF. As of time of publication, no patched versions are available.
- Product
- squidex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026Tendenci is an open source content management system built for non-profits, associations and cause-based sites.CVE-2026-23946 · Other software · tendenci · reported by GitHubMedium 6.8
Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use safe JSON deserialization, the run_report() function still uses unsafe pickle.loads(). The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions. This issue has been fixed in version 15.3.12.
- Product
- tendenci
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.python.orggithub.com
Jan 19, 2026Alchemy is an open source content management system engine written in Ruby on Rails.CVE-2026-23885 · Other software · AlchemyCMS · reported by GitHubMedium 6.4
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute in `Alchemy::ResourcesHelper#resource_url_proxy`. The vulnerability exists in `app/helpers/alchemy/resources_helper.rb` at line 28. The code explicitly bypasses security linting with `# rubocop:disable Security/Eval`, indicating that the use of a dangerous function was known but not properly mitigated. Since `engine_name` is sourced from module definitions that can be influenced by administrative configurations, it allows an authenticated attacker to escape the Ruby sandbox and execute arbitrary system commands on the host OS. Versions 7.4.12 and 8.0.3 fix the issue by replacing `eval()` with `send()`.
- Product
- alchemy_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026October is a Content Management System (CMS) and web platform.CVE-2025-61676 · Other software · octobercms · reported by GitHubMedium 6.1
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms. A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Styles from Branding & Appearance settings. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026October is a Content Management System (CMS) and web platform.CVE-2025-61674 · Other software · octobercms · reported by GitHubMedium 6.1
October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerability was identified in October CMS backend configuration forms. A user with the Global Editor Settings permission could inject malicious HTML/JS into the stylesheet input at Markup Styles. A specially crafted input could break out of the intended <style> context, allowing arbitrary script execution across backend pages for all users. This issue has been patched in versions 3.7.13 and 4.0.12.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22597 · Other software · TryGhost · reported by GitHubMedium 5.1
Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22596 · Other software · TryGhost · reported by GitHubMedium 6.7
Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22595 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026Ghost is a Node.js content management system.CVE-2026-22594 · Other software · TryGhost · reported by GitHubHigh 8.1
Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA. This issue has been patched in versions 5.130.6 and 6.11.0.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Kirby is an open-source content management system.CVE-2026-21896 · Other software · getkirby · reported by GitHubMedium 5.8
Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026REDAXO is a PHP-based content management system.CVE-2026-21857 · Other software · redaxo · reported by GitHubHigh 8.3
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.
- Product
- redaxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Tina is a headless content management system.CVE-2025-68278 · Other software · tinacms · reported by GitHubHigh 7.3
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2025nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.CVE-2025-65590 · Websites & servers · Nopcommerce · reported by MITREMedium 5.4
nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area.
- Product
- Nopcommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgnopcommerce.com
Dec 15, 2025A weakness has been identified in CTCMS Content Management System up to 2.1.2.CVE-2025-14731 · Other software · CTCMS · reported by VulDBLow 2.1
A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser.php of the component Frontend/Template Management Module. This manipulation causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comnote-hxlab.wetolink.com
Dec 15, 2025A security flaw has been discovered in CTCMS Content Management System up to 2.1.2.CVE-2025-14730 · Other software · CTCMS · reported by VulDBLow 2
A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_Config.php of the component Backend System Configuration Module. The manipulation of the argument Cj_Add/Cj_Edit results in code injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Dec 15, 2025A vulnerability was identified in CTCMS Content Management System up to 2.1.2.CVE-2025-14729 · Other software · CTCMS · reported by VulDBLow 2
A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
- Product
- Content Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Dec 12, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2025-66492 · Other software · MasaCMS · reported by GitHubHigh 8.2
Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025WBCE CMS is a content management system.CVE-2025-65950 · Other software · WBCE · reported by GitHubCritical 9.4
WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to modify users to execute arbitrary SQL queries. This can be escalated to a full database compromise, data exfiltration, effectively bypassing all security controls. The vulnerability exists in the admin/users/save.php script, which handles updates to user profiles. The script improperly processes the groups[] parameter sent from the user edit form. This issue is fixed in version 1.6.5.
- Product
- WBCE_CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025WBCE CMS is a content management system.CVE-2025-67504 · Other software · WBCE · reported by GitHubCritical 9.1
WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHP's rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
- Product
- WBCE_CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Dec 8, 2025WBCE CMS is a content management system.CVE-2025-66204 · Other software · WBCE · reported by GitHubMedium 6.3
WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The application fully trusts the `X-Forwarded-For` header without validating it or restricting its usage. This issue is fixed in version 1.6.5.
- Product
- WBCE_CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32643 · Other software · MasaCMS · reported by GitHubHigh 7.5
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32642 · Other software · MasaCMS · reported by GitHubHigh 8.8
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.