CVE-2026-21429

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete their articles after publishing them. As of time of publication, no known patched versions are available.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jan 2, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-21437.2A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddnCVE-2026-214309.3Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgeCVE-2026-214315.4Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media libraCVE-2026-214325.4Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takCVE-2026-214337.7Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requestCVE-2026-214347.5webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption iCVE-2026-214357.5webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtranspoCVE-2026-214365.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `CVE-2026-214375.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not trCVE-2026-214385.3webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeaCVE-2026-214395.3badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker maCVE-2026-21448.1The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This
CVE-2026-21429: Medium severity, CVSS 4.3 | Vulnix