{"vulnerability": "cve-2026-5462", "sightings": [{"uuid": "04302b67-cef8-4cd8-abe3-f80d73e2f927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5462", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3milawjfgj424", "content": "", "creation_timestamp": "2026-04-03T08:01:21.632596Z"}, {"uuid": "bee51789-cddd-4ecf-9219-30d9de29f8b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54624", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/e7h75nllkvmwl", "content": "CVE-2026-54624 - django CMS: Structure endpoint bypasses page-view permission\nCVE ID : CVE-2026-54624\n \n Published : Aug. 20, 2026, 7:16 p.m. | 37\u00a0minutes ago\n \n Description : django CMS is an easy-to-use and developer-friendly enterprise content management system powered by D...", "creation_timestamp": "2026-08-20T20:07:19.777052Z"}, {"uuid": "b49b8fd9-380c-4eb2-9e6e-cfed5bb0c3cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54629", "type": "published-proof-of-concept", "source": "https://github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784", "content": "", "creation_timestamp": "2026-07-14T22:35:09.437807Z"}, {"uuid": "5074fa07-02b2-4e15-836a-0e39eb78cdd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54628", "type": "published-proof-of-concept", "source": "https://github.com/julien040/anyquery/security/advisories/GHSA-hwrq-8wxh-q4xv", "content": "", "creation_timestamp": "2026-07-14T22:35:13.842304Z"}, {"uuid": "65252c7b-b4b6-488c-b7b8-4dc60e3490f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54623", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtuhyepjeo2x", "content": "CVE-2026-54623 in django CMS: move_plugin accepts a plugin_parent with no cycle check, so a plugin can be reparented under its own descendant. The recursive ancestor queries then never terminate and the request worker stalls. #dev", "creation_timestamp": "2026-08-24T23:38:46.465064Z"}, {"uuid": "6113c4ad-4836-404d-84a8-29e7867a9af6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54621", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mrqy32ujko2l", "content": "datamodel-code-generator 0.60.1\u672a\u6e80\u3067\u3001GraphQL Union\u306edescription\u306b\u4e0d\u6b63\u306a\u30b3\u30fc\u30c9\u304c\u542b\u307e\u308c\u308b\u3068\u3001\u751f\u6210\u3055\u308c\u305fPython\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-54621 CVSS 7.8 | HIGH", "creation_timestamp": "2026-07-29T03:25:34.345308Z"}, {"uuid": "bd485eca-b770-4e79-b357-a6b0d2133e15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54625", "type": "seen", "source": "https://gist.github.com/alon710/818add0e0ce97b333c2bed9ff2722107", "content": "# CVE-2026-54625: CVE-2026-54625: Server-Side Page Cache Bypass and Cache Poisoning in django CMS\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54625\n\n## Summary\nPrior to version 5.0.8, django CMS fails to respect dynamically declared Vary HTTP headers in its internal page cache. This allows remote attackers to bypass authorization, leak sensitive information across user sessions, or poison the page cache by sending requests with custom headers.\n\n## TL;DR\ndjango CMS versions before 5.0.8 and 5.1.0 contain a cache key computation flaw that ignores plugin-declared HTTP Vary headers, leading to server-side cache poisoning and information disclosure.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-524 / CWE-349\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.8\n- **EPSS Score**: 0.00147\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- django-cms\n- **django-cms**: < 5.0.8 (Fixed in: `5.0.8`)\n- **django-cms**: >= 5.1.0a1, < 5.1.0 (Fixed in: `5.1.0`)\n\n## Mitigation\n\n- Disable internal page caching by setting CMS_PAGE_CACHE = False\n- Upgrade to django CMS version 5.0.8 or 5.1.0\n- Sanitize or strip custom vary headers at the upstream reverse proxy or CDN level\n\n**Remediation Steps:**\n1. Upgrade django-cms using pip: pip install --upgrade django-cms>=5.0.8\n2. Verify the application configuration and test plugin cache partitions\n3. Clear existing cache entries using the cache backend's management tools or the Django caching API\n4. Ensure upstream CDNs or proxies are configured to prevent header injection from untrusted clients\n\n## References\n\n- [GitHub Security Advisory GHSA-fwjf-m4qw-9f2x](https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x)\n- [NVD CVE-2026-54625 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-54625)\n- [django CMS Pull Request 8646](https://github.com/django-cms/django-cms/pull/8646)\n- [django CMS Pull Request 8647](https://github.com/django-cms/django-cms/pull/8647)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54625) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T14:31:38.973813Z"}, {"uuid": "2402a258-5bef-4c6c-966f-738f4b9be88e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54627", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvqkeikbtr2w", "content": "\ud83d\udd34 CVE-2026-54627 - Critical (9.8)\n\nSAIL is a cross-platform library for loading and saving images with support for animation, metada...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54627/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-17T21:01:05.180071Z"}, {"uuid": "a3881938-a273-418c-94e4-9fdf91dace99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54626", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvqo3scsmo2g", "content": "\ud83d\udea8 CVE-2026-54626 \u2014 CVSS 9.8 CRITICAL\n\nSAIL is a cross-platform library for loading and saving images with support for animation, metadata, and IC...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-54626\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T22:07:47.171758Z"}, {"uuid": "da7e436a-e4d2-4aa0-8a90-8c9e57a7924b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54627", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvqo42eegg25", "content": "\ud83d\udea8 CVE-2026-54627 \u2014 CVSS 9.8 CRITICAL\n\nSAIL is a cross-platform library for loading and saving images with support for animation, metadata, and IC...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-54627\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T22:07:55.690181Z"}, {"uuid": "08413980-e5c7-44a7-adf5-bdf1e47a1eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54626", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvqoli4dbi2u", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-54626: SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-54626\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-17T22:16:33.646322Z"}, {"uuid": "f22dedc9-fc99-470e-a512-1d03394de396", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54627", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvqxpui2sw24", "content": "CVE-2026-54627 - sail\nThe Sail library used for loading and saving images may write outside its memory when opening specially crafted Photoshop PSD files. This can cause the program to crash or, in rare\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sail #happyseafox #CVE #infosec", "creation_timestamp": "2026-09-18T01:00:04.757674Z"}, {"uuid": "d811effe-a302-4317-aaaf-13d1203787af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54626", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvqybsc6u32w", "content": "CVE-2026-54626 - sail\nVersions of the happyseafox SAIL image library up to 0.9.10 may write data past the end of memory when opening specially crafted TGA files. This can corrupt the program, cause it to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sail #happyseafox #CVE #infosec", "creation_timestamp": "2026-09-18T01:10:05.765679Z"}]}