CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

EUVD-2026-76246

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

PT-2026-90054

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An issue exists where the system fails to validate an anti-CSRF token a unique token used to prevent Cross-Site Request Forgery, where an attacker tricks a user into performing actions they did...

PT-2026-64700

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An uninitialized heap leak exists in the ALSA sequencer. The snd seq event dup function copies an incoming event into a pool cell. In UMP-enabled builds, a check is performed to clear th...

CVE-2025-12954

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor...

CVE-2025-12954

The Timetable and Event Schedule by MotoPress WordPress plugin, in versions prior to 2.4.16 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to perform adequate access validation when duplicating specific events, allowing users with roles as low as Contributor...

EUVD-2025-200729

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor...