django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

CVE-2026-54623

### Summary The `move_plugin` admin endpoint does not prevent a plugin from being reparented under itself or one of it

历史摘要 · 未重新核验 · GitHub Advisory

Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

CVE-2026-68508

## Summary `hydra.utils.instantiate()` resolves and calls Python objects from config. If an application passes untruste

历史摘要 · 未重新核验 · GitHub Advisory

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

CVE-2026-61539

### Summary Xinference used Python's unsafe `eval()` function when parsing Llama3 tool-call output generated by a large

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Improper restriction handling on Page translation API endpoint

### Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoi

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Improper permission handling when copying snippets

### Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an e

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

### Impact The Documents and Images [API V2](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorre

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Identification of documents by SHA1 hash

### Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whethe

历史摘要 · 未重新核验 · GitHub Advisory

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

CVE-2026-61663

## Summary The django-cms frontend-editing structure endpoint ``` GET //admin/cms/placeholder/object//structure// ```

历史摘要 · 未重新核验 · GitHub Advisory

django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)

CVE-2026-63003

## Impact The only authorization gate on the duplicate flow is `PageAdmin.has_add_permission`, which checks `user_can_a

历史摘要 · 未重新核验 · GitHub Advisory

django CMS: Stored XSS in edit-mode plugin exception rendering

CVE-2026-75526

## Summary When plugin rendering fails in edit mode, django CMS renders a `cms-rendering-exception` block so editors ca

历史摘要 · 未重新核验 · GitHub Advisory

Wagtail: Improper restriction handling on Pages admin API

CVE-2026-55468

### Impact The internal Pages admin [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectl

历史摘要 · 未重新核验 · GitHub Advisory

django CMS: Structure endpoint bypasses page-view permission

CVE-2026-54624

### Summary The structure-board endpoint (`render_object_structure`) renders a page's plugin structure without verifying

历史摘要 · 未重新核验 · GitHub Advisory

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain

历史摘要 · 未重新核验 · GitHub Advisory

Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

CVE-2026-53964

### Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be e

历史摘要 · 未重新核验 · GitHub Advisory

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

CVE-2026-53951

# Copier: trust-prefix bypass via path traversal runs tasks unprompted ### Summary In copier `>= 9.5.0, str: if u

历史摘要 · 未重新核验 · GitHub Advisory

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

CVE-2026-55236

## Summary In affected versions of `langgraph-api` (the LangGraph Server runtime), the run-creation path authorized the

历史摘要 · 未重新核验 · GitHub Advisory

langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

CVE-2026-55235

## Summary In affected versions of `langgraph-api` (the LangGraph Server runtime), a run or cron could be created with

历史摘要 · 未重新核验 · GitHub Advisory

linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

CVE-2026-73974

## Summary Every Linuxfabrik check plugin that supports the shared `--test` argument (routed through `lib.lftest.test()`

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

CVE-2026-71417

## Summary Repo under test: https://github.com/Netflix/lemur `PUT /api/1/certificates//revoke` authorizes the caller a

历史摘要 · 未重新核验 · GitHub Advisory

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

CVE-2026-71322

## Summary The `CertificateExport` handler in `lemur/certificates/views.py` nests its entire ownership / `CertificateP

历史摘要 · 未重新核验 · GitHub Advisory