[MEDIUM] Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

PKSA-mg6n-7v6r-wbcq CVE-2026-92692 GHSA-jg26-q8hg-3pq4

Affected version: >=3.0.0,<3.0.8|<2.6.25

Reported by:
GitHub

[MEDIUM] Sulu: Stored XSS via media download inline-disposition override

PKSA-nbbf-nf63-19vd CVE-2026-82396 GHSA-pp4x-ccxq-6r33

Affected version: >=3.0.0-alpha1,<3.0.8|<=2.6.24

Reported by:
GitHub

[MEDIUM] Sulu: Fix authorization bypass when creating preview links

PKSA-2gwf-7fts-yzvv CVE-2026-82394 GHSA-65cv-w493-7vhq

Affected version: >=3.0.0-alpha1,<3.0.8|<=2.6.24

Reported by:
GitHub

[MEDIUM] Sulu: Media move/update authorization bypass (IDOR)

PKSA-zmfc-sgjt-9gmb CVE-2026-82395 GHSA-h6cx-gjxx-v25c

Affected version: >=3.0.0-alpha1,<3.0.8|<=2.6.24

Reported by:
GitHub

[LOW] Sulu: Used API Keys may be available via Admin API

PKSA-2mt7-sd38-1xng GHSA-9m6v-8fxc-4r44

Affected version: <=2.6.22|>=3.0.0-alpha1,<=3.0.5

Reported by:
GitHub

[MEDIUM] Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

PKSA-psv3-gm5n-8wm5 CVE-2026-45701 GHSA-7fv8-6pp7-6h85

Affected version: <=2.6.22|>=3.0.0-alpha1,<=3.0.5

Reported by:
GitHub

[MEDIUM] Sulu checks fix permissions for subentities endpoints

PKSA-s8fv-tzzv-5y3k CVE-2026-34372 GHSA-6h7h-m7p5-hjqp

Affected version: >=3.0.0,<3.0.5|>=1.0.0,<2.6.22

Reported by:
GitHub

[HIGH] PHP file inclusion in the Sulu admin panel

PKSA-vy6d-prcg-w42z CVE-2021-43836 GHSA-vx6j-pjrh-vgjh

Affected version: =2.4.0-RC1|>=2.3.0,<2.3.8|>=2.0.0,<2.2.18|<1.6.44

Reported by:
GitHub

[MEDIUM] Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu

PKSA-gccp-7sgc-fjvt CVE-2021-41169 GHSA-h58v-g3q6-q9fx

Affected version: <1.6.43

Reported by:
GitHub

[MEDIUM] XSS Injection in Media Collection Title was possible

PKSA-7zp7-xygz-tgfc CVE-2021-32737 GHSA-gm2x-6475-g9r8

Affected version: <1.6.41

Reported by:
GitHub

[MEDIUM] Reset Password / Login vulnerability in Sulu

PKSA-4jvw-2x8g-dmx9 CVE-2020-15132 GHSA-wfm4-pq59-wg6r

Affected version: >=2.1.0,<2.1.1|>=2.0.0,<2.0.10|<1.6.34

Reported by:
GitHub