CVE-2026-18113 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...

EUVD-2026-78904

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...

CVE-2026-18113 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...

CVE-2026-18113

Concrete CMS 9.0 through 9.5.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Top Navigation Bar block . The block failed to HTML-escape dropdown child page names before rendering them into the page, allowing a user with page-creation or renaming privileges to inject a sc...

CVE-2026-18113: Improper Neutralization of Input During Web Page Generation

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...

PT-2026-92165

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0 through 9.5.2 Description The Top Navigation Bar block fails to HTML-escape dropdown child page names before rendering them on the page. This allows a user with permissions to create or rename pages to inject a...

CVE-2026-43696

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization...

CVE-2026-43696

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization...

EUVD-2026-77901

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization...

CVE-2026-43696

CVE-2026-43696 is an authorization flaw in macOS where an app may be able to capture Touch Bar content without user authorization. The root cause is insufficient entitlement checks, addressed in the fix. The issue is resolved in macOS Golden Gate 27 , which is the recommended remediation. NVD ass...

Astra Linux – Vulnerability in Thunderbird

An attacker could create a malicious link that uses bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox 117, Firefox ESR 115.4, and Thunderbird 115.4.1...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved user interface. This issue has been fixed in Safari 18.6, iOS 18.6, and iPadOS 18.6. Visiting a malicious website may result in address bar spoofing...

Astra Linux – Vulnerability in Firefox and Thunderbird

A malicious website that could create a popup might resize the popup to overlay the address bar with its own content, causing potential confusion for users or leading to spoofing attacks. This bug only affects Thunderbird for Linux. Other operating systems are unaffected.. This vulnerability...

Astra Linux – Vulnerability in Firefox

A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. This vulnerability affects Firefox 122...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The incorrect security interface in the Loader component in Google Chrome prior to version 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar through a crafted HTML page...

Astra Linux – Vulnerability in Firefox

When a network error occurred during page loading, the previous content could remain visible, accompanied by a blank URL bar. This could be used to disguise a spoofed website. This vulnerability affects Firefox versions earlier than 126...

CVE-2026-43696: Missing Authorization

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization...

PT-2026-91490

Name of the Vulnerable Software and Affected Versions macOS versions prior to Golden Gate 27 Description An authorization issue exists where an application may capture Touch Bar content without proper authorization. This is caused by insufficient entitlement checks, which are permissions granted ...

Xen: Improper Handling of HVM Emulation Return Codes (XSA-510)

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG in Xen. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...