Vulnerabilities
Craft CMS Critical Flaw Lets Tokens Alter Multi-Site Content
A severe authorization bypass in Craft CMS versions before 5.11.0 allows attackers to modify or delete content across different sites using a single token.
CVSS 9.3
Everything Patch Herald has reported about CVSS 9.3: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
TMS Amelia 2.4.10 SQL Injection (CVE-2026-108497) Lets Attackers Manipulate Databases
A severe flaw in the TMS Amelia booking plugin allows database manipulation. No patch has been confirmed for versions through 2.4.10 yet.