PT-2026-93854

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.2.0 through 9.5.3 Description The REST API user creation endpoint 'POST /ccm/api/1.0/users', specifically the add function in concrete/src/Api/Controller/Users.php, fails to perform a permission check before creating an...

PT-2026-94107

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.7.0 through 5.10.12 Description A stored cross-site scripting issue exists in the Generated Fields feature. The flaw occurs because Twig autoescaping is disabled and cached values are not encoded. This allows content edito...

PT-2026-93264

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

PT-2026-94108

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.12 Description A failure in the database connection is incorrectly interpreted as the software not being installed. This allows anonymous installer actions, such as install/validate-site, to be accessed on...

CVE-2026-92589: Missing Authorization

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-85386: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploads were validated by file extension only and stored as publicly accessible files that were served inline from the application's own origin. An unauthenticate...

PT-2026-93847

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.4 Description Insufficient sanitization of XML and XSLT documents uploaded via a public Form Block file-upload question allows an unauthenticated visitor to store a malicious XML document. Because plain XML...

PT-2026-93846

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.4 Description Stored cross-site scripting occurs because the software fails to validate the uTimezone value during write operations and renders it without output encoding on the Dashboard user management page...

PT-2026-94111

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.x Description Incorrect authorization occurs in the GraphQL draftCreator and revisionCreator fields. Instead of requiring the user-data scope enforced by the canQueryUsers function usergroups.:read,...

CVE-2026-92594: Exposure of Sensitive Information to an Unauthorized Actor

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

CVE-2026-92247: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-18426

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-81927 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-81927 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-81927 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

EUVD-2026-79945

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored XSS vulnerability in its SVG file handling. The flaw is triggered only when SVG sanitization is set to the non-default "reject" mode (concrete.file_manager.images.svg_sanitization.action = reject). In that mode, uploaded SVGs were checked against a sma...

CVE-2026-81925

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...