These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-93366 debrief based on the supplied source corpus. The Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators. This vulnerability bypasses the IMAGE_RESTRICT isolation control, allowing unauthorized data access and deletion. A [truncated]
CVE-2026-93365 debrief based on the supplied source corpus. Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint in bl-kernel/ajax/content-get-list.php. Th [truncated]
CVE-2026-93364 is a mass assignment vulnerability in Bludit CMS through version 3.22.0. Authenticated users with the Author role can modify privileged page fields by injecting reserved parameters into a content save request, potentially allowing them to convert pages to static site-wide navigation entries or transfer page ownership. This vulnerability has a medium severity and requires immediate attention [truncated]
A stored cross-site scripting (XSS) vulnerability exists in Bludit 4.0.0-beta. The vulnerability allows low-privileged authenticated users to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The script executes in the browser of any user who loads the logo. This vulnerability has a CVSS score of 5.4 and is classified as MEDIUM severity. System administrators and security teams [truncated]
CVE-2026-50869 is a directory traversal vulnerability in the api/plugin.php component of Bludit v3.19.0. An attacker can exploit this vulnerability by supplying a crafted request, potentially leading to unauthorized access to sensitive files and data.
CVE-2026-38329 is a Remote Code Execution (RCE) vulnerability in Bludit CMS before version 3.18.4. The vulnerability is caused by the lack of authorization and file extension validation in the POST /api/files/{key} endpoint in bl-plugins/api/plugin.php. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server. For more information, see [cve-org](https:/ [truncated]
CVE-2026-46656 is a high-severity vulnerability in Bludit, a content management system. Versions prior to 3.22.0 are affected by a Broken Access Control flaw, which allows active sessions to remain valid even after the corresponding user account has been physically deleted from the database. This 'Ghost Session' enables revoked users to maintain full unauthorized access to the system. The vulnerability ha [truncated]
CVE-2026-41456 is a reflected cross-site scripting vulnerability in the search plugin of Bludit CMS prior to commit 6732dde. This vulnerability allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing [truncated]
CVE-2026-27742 is a stored cross-site scripting (XSS) vulnerability in Bludit version 3.16.2. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding.
CVE-2026-27741 is a cross-site request forgery vulnerability in Bludit 3.16.1. The application lacks anti-CSRF tokens for administrative actions, allowing an attacker to induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This vulnerability can lead to loss of functionality, execution [truncated]