https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:09:12.337869+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277362 EUVD-2026-277362 2026-10-06T12:09:12.387052+00:00 EUVD-2026-277362 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33172 fkie_cve-2026-33172 2026-10-06T12:09:12.387090+00:00

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed. This has been fixed in 5.73.14 and 6.7.0.

 https://cve.radiocsirt.org/vuln/ghsa-7rcv-55mj-chg7 GHSA-7rcv-55mj-chg7 — Statamic has Stored XSS via SVG Sanitization Bypass 2026-10-06T12:09:12.387123+00:00

Affected: Packagist: statamic/cms

### Impact

Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed.

### Patches

This has been fixed in 5.73.14 and 6.7.0.