漏洞公告

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

django CMS: Structure endpoint bypasses page-view permission

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Wagtail: Reflected XSS in dynamic image URL generator view

Wagtail: Pages translations can be created without page permissions when using simple_translation

Wagtail: Improper permission handling in image preview

Wagtail: Denial of service via unbounded filter specs in the image preview

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers