https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:08:47.028437+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-222919 EUVD-2026-222919 2026-10-06T05:08:47.091793+00:00 EUVD-2026-222919 https://cve.radiocsirt.org/vuln/fkie_cve-2025-2304 fkie_cve-2025-2304 2026-10-06T05:08:47.091834+00:00

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.

 https://cve.radiocsirt.org/vuln/ghsa-rp28-mvq3-wf8j GHSA-rp28-mvq3-wf8j — Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment 2026-10-06T05:08:47.091871+00:00

Affected: RubyGems: camaleon_cms

A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.