Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
🟠 October CMS, Safe Mode Bypass, #CVE-2026-26067 (Medium) https://dailycve.com/october-cms-safe-mode-bypass-cve-2026-26067-medium/
Post summary
The post announces CVE-2026-26067 as a Safe Mode Bypass in October CMS, links to a DailyCVE article for details, but provides no evidence of exploitation, patches, or PoC code within the excerpt.
🚨*CVE* CVE-2026-26067 October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the ha… https://www.cve.org/CVERecord?id=CVE-2026-26067 ----- Traducción: CVE-2026-26067 Oct… http://infoflow.cloud`
Post summary
The post announces the disclosure of CVE‑2026‑26067, detailing a server‑side information disclosure flaw in certain CMS versions and linking to the official CVE record.
CVE-2026-26067 October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the ha… https://www.cve.org/CVERecord?id=CVE-2026-26067
Post summary
The statement announces CVE-2026-26067 as a server‑side information disclosure flaw affecting Oct CMS versions before 3.7.14 and 4.1.10, providing only basic vulnerability description.