Advisories · Technology

owen2345 Camaleon CMS.

Every CVE that names owen2345 Camaleon CMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120430 CVE record

CVSS 5.3 Medium

Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController
- owen2345 Camaleon CMS
- Broken access control
Not analysed yet 2 Nov 2026
CVE-2026-120429 CVE record

CVSS 7.1 High

Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController
- owen2345 Camaleon CMS
- Broken access control
Not analysed yet 2 Nov 2026
CVE-2026-116009 CVE record

CVSS 8.7 High

Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
- owen2345 camaleon-cms
- Path traversal
Not analysed yet 24 Oct 2026
CVE-2026-102261 CVE record

CVSS 5.3 Medium

owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
- owen2345 Camaleon CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-67616 CVE record

CVSS 5.3 Medium

Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
- owen2345 camaleon-cms
- Broken access control
Not analysed yet 3 Aug 2026
CVE-2026-66748 CVE record

CVSS 8.7 High

Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
- owen2345 camaleon-cms
- Code injection
Not analysed yet 28 Jul 2026