EUVD-2026-76244

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463

NL Portal Backend Libraries (Dutch government portal backend) contained a missing per-user authorization in two GraphQL resolver areas. The nl.nl-portal:documenten-api package (all versions up to 3.0.0) and nl.nl-portal:besluiten package (1.5.0–3.0.0) both declared resolvers without an authentica...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-81912

Concrete CMS before 9.5.3 contains a Cross-Site Request Forgery (CSRF) flaw in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, allowing a state-changing group move to be processed agains...

EUVD-2026-76243

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-62089

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

WordPress DT LMS – elearning, WordPress LMS Plugin plugin <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by adhikara13 in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.1...

CVE-2026-81909

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...

CVE-2026-81908

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

EUVD-2026-76194

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

CVE-2026-62089 WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

CVE-2026-62089

CVE-2026-62089 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Master Addons for Elementor by Pixar Labs, affecting versions from n/a through 3.2.2 . The flaw allows Privilege Abuse , enabling a low-privilege authenticated user to exploit the missing autho...

CVE-2026-18122

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to revoked access and refresh tokens remaining valid and being reported as active by the token introspection service, which allows an attacker to continue using revoked tokens to access protected resources...

CVE-2026-81909 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...

CVE-2026-81909

Concrete CMS versions 9 through 9.5.2 contain a Missing Authorization flaw in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php). The function fails to verify that a referenced block is genuinely orphaned on the target page and that the caller holds permiss...

CVE-2026-81909 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...

EUVD-2026-76168

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to a flaw in the removeCodeGrant functionality that allows authorization codes to remain reusable, which allows an attacker who captures a valid authorization code to redeem it multiple times and obtain multiple valid...