121985 matches found
CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control
Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...
CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control
Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...
CVE-2026-18421
Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...
CVE-2026-18421
Concrete CMS versions 9 through 9.5.2 contain a missing authorization check in the Boards data source dashboard controller . The three affected actions (update , update_data_source , and delete_data_source ) resolve a ConfiguredDataSource directly from an attacker-supplied identifier without conf...
CVE-2026-88716
creationtimestamp| type| source ---|---|--- 2026-09-15 18:16:30+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3mvlaafmybm2c...
CVE-2024-58385
creationtimestamp| type| source ---|---|--- 2026-09-15 18:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvl7rweto62j 2026-09-15 18:30:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlayru7v62j 2026-09-15 21:20:17+00:00| seen|...
CVE-2026-91949
creationtimestamp| type| source ---|---|--- 2026-09-15 18:07:58+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvl7r563g22r 2026-09-15 18:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlagsygiv2g...
CVE-2026-39919
creationtimestamp| type| source ---|---|--- 2026-09-15 16:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvkz3a5diy24 2026-09-15 17:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvl67bo4er2r 2026-09-17 02:19:54+00:00| seen|...
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-55178
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC/STAC APIs, and a map builder. Prior to 1.2.3 , multiple read and link endpoints authorized only the resource named in the request URL but failed to re-authorize a second caller-influenced dataset reached through a relation...
CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
EUVD-2026-78775
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...
CVE-2026-91998
creationtimestamp| type| source ---|---|--- 2026-09-15 13:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6qzzxavbnrej6 2026-09-15 14:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvksenru5t2f 2026-09-15 17:30:04+00:00| seen|...
CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...
CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...
CVE-2026-89308
creationtimestamp| type| source ---|---|--- 2026-09-15 08:45:06+00:00| seen| https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza 2026-09-15 12:00:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mvkl7ypncf24 2026-09-15 13:38:12+00:00| seen|...
CVE-2026-86701
creationtimestamp| type| source ---|---|--- 2026-09-15 08:45:02+00:00| seen| https://jvn.jp/en/jp/JVN72918755...