CVE-2026-88421

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-09-30
Weakness: CWE-284

Description

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed.

References

https://gist.github.com/itsmohitnarayan/736225bd6cd79031a5dfbf56acdb14ae
https://gist.github.com/itsmohitnarayan/736225bd6cd79031a5dfbf56acdb14ae

Get alerted when CVE-2026-88421 or the next vulnerability affects your stack