Security advisories

medium2026-08-20

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

View chart →

fleetdm/fleet · GHSA-q9c5-pp7m-fm2g

high2026-08-20

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

View chart →

wintercms/winter · GHSA-8cfw-pcwh-v63w

medium2026-08-20

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

View chart →

wintercms/winter · GHSA-2223-f22x-24cq

high2026-08-20

CVE-2026-63202-netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

View chart →

netty/netty-incubator-codec-ohttp · GHSA-4899-mpch-38p3

medium2026-08-20

CVE-2026-63179-Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

View chart →

wintercms/winter · GHSA-58fp-mcx6-7qf9

high2026-08-20

CVE-2026-61827-netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

View chart →

netty/netty-incubator-codec-ohttp · GHSA-hmq9-67w8-j5pw

high2026-08-20

CVE-2026-63124-netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

View chart →

netty/netty-incubator-codec-ohttp · GHSA-8cfx-wx3q-mh5q

medium2026-08-20

CVE-2026-61799-netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

View chart →

netty/netty-incubator-codec-ohttp · GHSA-pgrf-4654-3gq8

high2026-08-20

CVE-2026-61798-netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

View chart →

netty/netty-incubator-codec-ohttp · GHSA-2mc4-j865-9q4r

medium2026-08-20

CVE-2026-61663-django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

View chart →

django-cms/django-cms · GHSA-8qj2-c6q4-f399

medium2026-08-20

CVE-2026-63003-django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

View chart →

django-cms/django-cms · GHSA-6x92-6vx4-5fwr

medium2026-08-20

CVE-2026-75526-django CMS: Stored XSS in edit-mode plugin exception rendering

View chart →

django-cms/django-cms · GHSA-hvq6-2r72-p2x7

medium2026-08-20

CVE-2026-57570-Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

View chart →

laravel-backpack/crud · GHSA-42vx-43vc-x6pr

medium2026-08-20

CVE-2026-55468-Wagtail: Improper restriction handling on Pages admin API

View chart →

wagtail/wagtail · GHSA-3vrh-m9w7-v94f

high2026-08-20

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

View chart →

nocobase/nocobase · GHSA-ghvf-qf6h-g8x5

medium2026-08-20

CVE-2026-54624-django CMS: Structure endpoint bypasses page-view permission

View chart →

django-cms/django-cms · GHSA-vgxm-h9gx-h9w7

medium2026-08-20

CVE-2026-54622-django CMS: Clipboard copy IDOR discloses unauthorized plugin content

View chart →

django-cms/django-cms · GHSA-4xfr-4p46-gc6p

high2026-08-20

CVE-2026-54263-Wagtail: Reflected XSS in dynamic image URL generator view

View chart →

wagtail/wagtail · GHSA-23m2-mghx-vqmf

medium2026-08-20

CVE-2026-54262-Wagtail: Pages translations can be created without page permissions when using simple_translation

View chart →

wagtail/wagtail · GHSA-8634-mr4j-r72c

medium2026-08-20

CVE-2026-54261-Wagtail: Improper permission handling in image preview

View chart →

wagtail/wagtail · GHSA-r6p4-grq7-xm4m