24504 matches found
CVE-2026-8414
Concrete CMS 9.x before 9.5.0 is affected by a CSRF vulnerability in the endpoint concrete/controllers/dialog/event/duplicate. Technical details from PT-2026-42570 indicate versions 9.0.0 through 9.4.x are vulnerable, with exploitation via the affected endpoint. The recommended fix is to upgrade ...
CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...
CVE-2026-8414
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...
CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...
CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...
CVE-2026-8205 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...
CVE-2026-8205 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...
CVE-2026-8205
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...
EUVD-2026-31351
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...
CVE-2026-8204
Concrete CMS 9.5.0 and earlier versions are vulnerable to an authorization bypass in the Calendar Event Frontend Dialog, enabling potential cross-calendar data disclosure. A public calendar block can be used as a pivot to access private calendar data. The CVSS v4.0 base score is 6.3 (AV:N/AC:L/AT...
CVE-2026-48239
creationtimestamp| type| source ---|---|--- 2026-05-21 19:12:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf4tno6jl2h...
CVE-2026-48244
creationtimestamp| type| source ---|---|--- 2026-05-21 18:57:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf3y6tqux2e...
CVE-2026-43497
creationtimestamp| type| source ---|---|--- 2026-05-21 16:17:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmesyzrc762t 2026-07-06 06:15:06+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706 2026-08-03 07:28:33+00:00| seen...
CVE-2026-43494
creationtimestamp| type| source ---|---|--- 2026-05-21 12:56:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmehrqrwq72k 2026-05-22 08:21:59+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mmgiweecrly2 2026-05-25 08:00:04+00:00| seen|...
CVE-2026-99999
creationtimestamp| type| source ---|---|--- 2026-05-21 12:44:45+00:00| seen| https://bsky.app/profile/gonzokata.bsky.social/post/3mmeh53pwfk22 2026-06-19 12:04:49+00:00| seen| https://gist.github.com/shweta-tripathi-1519/c957e66dd8f0e7892e135a18982c486a...
CVE-2026-44073
creationtimestamp| type| source ---|---|--- 2026-05-21 10:43:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmeafaskb32i 2026-06-01 00:01:29+00:00| seen| https://bsky.app/profile/slackers.it/post/3mn6rmqdab727...
CVE-2026-38765
creationtimestamp| type| source ---|---|--- 2026-05-21 09:00:04+00:00| seen| Telegram/vpOabQVvb76izlIWt2pzp7PU5zl-D7jeeGQcHuuxEyFlkWM...
CVE-2026-6452
creationtimestamp| type| source ---|---|--- 2026-05-21 07:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmdvofn2xr2s...