CVE-2026-85234

creationtimestamp| type| source ---|---|--- 2026-09-15 19:31:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/azqvrwahpwbnb...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-92177

creationtimestamp| type| source ---|---|--- 2026-09-15 19:13:15+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvldfv6e752c 2026-09-15 20:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg22dequ23...

CVE-2026-92176

creationtimestamp| type| source ---|---|--- 2026-09-15 19:13:14+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvldftil4u2q 2026-09-15 20:03:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvlg7deuc522...

EUVD-2026-79187

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421

Concrete CMS versions 9 through 9.5.2 contain a missing authorization check in the Boards data source dashboard controller . The three affected actions (update , update_data_source , and delete_data_source ) resolve a ConfiguredDataSource directly from an attacker-supplied identifier without conf...

CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-88716

creationtimestamp| type| source ---|---|--- 2026-09-15 18:16:30+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3mvlaafmybm2c...

CVE-2024-58385

creationtimestamp| type| source ---|---|--- 2026-09-15 18:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvl7rweto62j 2026-09-15 18:30:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlayru7v62j 2026-09-15 21:20:17+00:00| seen|...

CVE-2026-91949

creationtimestamp| type| source ---|---|--- 2026-09-15 18:07:58+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvl7r563g22r 2026-09-15 18:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlagsygiv2g...

CVE-2026-39919

creationtimestamp| type| source ---|---|--- 2026-09-15 16:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvkz3a5diy24 2026-09-15 17:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvl67bo4er2r 2026-09-17 02:19:54+00:00| seen|...

CVE-2026-55178

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...

EUVD-2026-78775

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...

CVE-2026-55178

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC/STAC APIs, and a map builder. Prior to 1.2.3 , multiple read and link endpoints authorized only the resource named in the request URL but failed to re-authorize a second caller-influenced dataset reached through a relation...

CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...

CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...

CVE-2026-91998

creationtimestamp| type| source ---|---|--- 2026-09-15 13:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6qzzxavbnrej6 2026-09-15 14:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvksenru5t2f 2026-09-15 17:30:04+00:00| seen|...

CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...