Winter/wn-backend-module
9 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Winter/wn-backend-module, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Winter/wn-backend-module CVEs per month
| Month | CVEs |
|---|---|
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 6 |
| 2026-09 | 0 |
| 2026-10 | 0 |
Severity
How the 9 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- Low2
Latest CVEs
The 9 most recently published vulnerabilities affecting Winter/wn-backend-module.
- GHSA-hq84-x37p-j6q5Winter: Reflected XSS through the search query parameter in the backend Table widget—
- GHSA-p2ch-c2c3-4xm5Winter: CSRF through AJAX handler names reachable as backend page actions—
- GHSA-5cwr-5jxg-pcf6Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles—
- GHSA-fm29-4mq3-phg6Winter: ImportExportController AJAX handlers bypass granular import/export permission gate—
- GHSA-mpmw-f6h6-3g26Winter: My Account preview exposes another backend user's profile by record ID—
- GHSA-7mpf-4465-7fc2Winter: Stored XSS through Backend List widget image columns—
- CVE-2026-27591Winter: Privilege escalation by authenticated backend users9.9
- CVE-2023-52085Winter CMS Local File Inclusion through Server Side Template Injection 3.3
- CVE-2023-52084Winter CMS Stored XSS through Backend ColorPicker FormWidget2.0
Product grouping is registry-driven, with AI assist and human review. How it works