•34 minutes ago•CVE-2026-59995
4.2CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client
A relative path traversal vulnerability (CWE-23) in the client-side sftp utility of OpenSSH before version 10.4 allows malicious or compromised SFTP servers to write or overwrite files outside the intended destination directory when a user executes a direct one-shot download command.
2 views•6 min read
•about 2 hours ago•GHSA-RXHG-VCWW-2MPW
8.1GHSA-RXHG-VCWW-2MPW: SQL Injection via ORDER BY Column Injection in Fleet Activity List Endpoints
A SQL injection vulnerability exists in the activity list endpoints of Fleet Device Management. Authenticated users can manipulate the order_key parameter to sort database queries by arbitrary columns, including columns not projected in the SELECT query. This flaw allows attackers to establish an inference oracle to extract sensitive information from the database.
3 views•5 min read
•about 4 hours ago•GHSA-7MPF-4465-7FC2
2.0GHSA-7mpf-4465-7fc2: Stored Cross-Site Scripting in Winter CMS Backend List Widget
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Backend List widget of Winter CMS (winter/wn-backend-module). When a list column is configured with the 'image' type and displays attacker-controlled input, the lack of sanitization in the image URL allows injection of arbitrary HTML attributes, potentially executing malicious scripts in the session of administrators viewing the list.
2 views•5 min read
•about 5 hours ago•GHSA-MPMW-F6H6-3G26
4.3GHSA-mpmw-f6h6-3g26: Insecure Direct Object Reference in Winter CMS My Account Controller
An Insecure Direct Object Reference (IDOR) vulnerability was identified in Winter CMS version 1.2.13. The vulnerability exists within the newly introduced Backend\Controllers\MyAccount controller, which utilizes the FormController behavior without appropriate model query scoping or routing controls. This allows authenticated, low-privilege backend users to retrieve sensitive personal and administrative data of other backend accounts by enumerating record identifiers via standard CRUD routes.
3 views•5 min read
•about 6 hours ago•GHSA-FM29-4MQ3-PHG6
8.1GHSA-FM29-4MQ3-PHG6: Missing Authorization in Winter CMS ImportExportController Behavior
Winter CMS contains an authorization bypass vulnerability within its ImportExportController behavior. Due to a design flaw in the request lifecycle processing, permissions configured for data import and export operations are not validated during AJAX-based requests, allowing authenticated users with limited privileges to perform unauthorized data exfiltration or database manipulation.
4 views•5 min read
•about 7 hours ago•GHSA-5CWR-5JXG-PCF6
8.4GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles
Winter CMS versions prior to 1.2.14 are vulnerable to Stored Cross-Site Scripting (XSS) within the administrative backend interface. The flaw resides in the custom styles rendering pipeline for Brand Settings and Editor Settings. An attacker with privileges to modify backend branding or editor configurations can inject arbitrary JavaScript, which is written to the cache without sanitization. Subsequent page requests that result in a cache hit completely bypass output sanitization filters, leading to JavaScript execution in the sessions of other administrative users.
5 views•6 min read
•about 8 hours ago•GHSA-P2CH-C2C3-4XM5
8.8GHSA-P2CH-C2C3-4XM5: Cross-Site Request Forgery in Winter CMS AJAX Routing
Winter CMS contains a routing bypass vulnerability that allows Cross-Site Request Forgery (CSRF) attacks to trigger administrative AJAX handlers. Due to case-insensitivity in PHP's method resolution and an insufficiently strict check in the backend controller system, an attacker can invoke these handler methods through lowercase HTTP GET requests, bypassing default CSRF token validation.
4 views•4 min read
•about 9 hours ago•GHSA-HQ84-X37P-J6Q5
6.1GHSA-HQ84-X37P-J6Q5: Reflected Cross-Site Scripting in Winter CMS Backend Table Widget
A reflected Cross-Site Scripting (XSS) vulnerability exists in the backend Table widget of Winter CMS. The vulnerability is located within the search input template partial, where the application retrieves raw user inputs from the query parameters and renders them directly inside a raw-text script container without sanitization. An attacker can exploit this behavior by passing a crafted tag containing raw-text terminators, leading to code execution in the context of the victim's session.
3 views•5 min read
•about 10 hours ago•GHSA-92HV-J533-69WC
3.7GHSA-92HV-J533-69WC: Information Disclosure via ETag Conditional Matching in Wagtail CMS
An information disclosure vulnerability in the document serving subsystem of Wagtail CMS allows unauthorized users to verify if private documents match guessed SHA-1 hashes due to improper order of authentication checks.
4 views•7 min read
•about 11 hours ago•GHSA-C2XX-CJMH-9Q8F
5.3GHSA-C2XX-CJMH-9Q8F: Information Disclosure via Inherited Collection View Restriction Bypass in Wagtail API v2
An improper access control vulnerability in Wagtail's Documents and Images API V2 allows unauthenticated remote attackers to retrieve metadata (including titles and filenames) of files residing inside descendant collections of private parent collections, bypassing inherited view restrictions.
3 views•6 min read
•about 12 hours ago•GHSA-X5CX-W6P2-MXF2
6.5GHSA-X5CX-W6P2-MXF2: Improper Permission Handling in Wagtail Snippet Copy Functionality
An authorization bypass vulnerability in Wagtail CMS allows authenticated users with snippet creation privileges ('add') to access and view the contents of restricted snippet instances for which they lack viewing or editing permissions. By invoking the copy endpoint, the application pre-populates form data with the properties of the source snippet, exposing sensitive information to unauthorized users.
4 views•6 min read
•about 17 hours ago•GHSA-JM5P-837G-RV8G
6.5GHSA-JM5P-837G-RV8G: Insecure Direct Object Reference (IDOR) in Wagtail Page Translation Endpoint
An authenticated user with global translation permissions can exploit a missing authorization check on the page translation endpoint in Wagtail CMS. This allows the attacker to copy and view pages they do not have explicit edit or explore access to.
6 views•7 min read