SS-2026-004 - Password reset token account takeover

PKSA-s9ft-gn8c-nz8s

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-88987 - XSS via XHTML data URI

PKSA-3ddc-hhgt-bqh9 CVE-2026-88987

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-88988 - XSS via SVG data URI

PKSA-v91s-x13r-xsps CVE-2026-88988

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-88989 - Auth bypass GridFieldDetailForm

PKSA-byd1-vwr7-j3ng CVE-2026-88989

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-91110 - XSS using control bytes

PKSA-mxm6-h6dq-vmtc CVE-2026-91110

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-91112 - CMS_ACCESS_SecurityAdmin privilege escalation

PKSA-r36n-y55f-yj29 CVE-2026-91112

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-91113 - User-controlled ClassName allows unauthorized record type change

PKSA-2h3f-jtk1-8f25 CVE-2026-91113

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-91114 - Stored XSS via unescaped permission in PermissionCheckboxSetField

PKSA-2w11-jnmw-7vn5 CVE-2026-91114

Affected version: <6.2.13

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-91115 - RCE via i18nTextCollectorTask writer parameter

PKSA-bqyr-kn4k-vx5h CVE-2026-91115

Affected version: >=6.0.0,<6.2.13

Reported by:
FriendsOfPHP/security-advisories

[MEDIUM] CVE-2026-54720 - XSS attack through media embed

PKSA-x6tz-s6v3-ynk3 CVE-2026-54720 GHSA-gvrw-qqp5-jgc5

Affected version: <6.2.2

Reported by:
GitHub, FriendsOfPHP/security-advisories