CVE-2026-86359

creationtimestamp| type| source ---|---|--- 2026-09-16 17:46:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cp2ong6rm2k2q...

CVE-2026-87028

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

CVE-2026-20307

creationtimestamp| type| source ---|---|--- 2026-09-16 17:17:37+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117281853082467027 2026-09-16 18:08:35+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnqb5r45f25 2026-09-16 18:40:10+00:00| seen|...

CVE-2026-18120 Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

CVE-2026-92397

creationtimestamp| type| source ---|---|--- 2026-09-16 17:03:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvnmmmgovj22 2026-09-16 17:44:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/e7usvzdqy7jb6...

CVE-2026-92625

creationtimestamp| type| source ---|---|--- 2026-09-16 17:03:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvnmm5u45724 2026-09-16 17:07:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dj3e3yp7cz2xw...

CVE-2026-87028

CVE-2026-87028 is a cross-board Insecure Direct Object Reference (IDOR) in the Board Custom Slot Preview endpoint of Concrete CMS 9.0.0 through 9.5.3 . The endpoint failed to verify that a submitted InstanceItem belonged to the board instance the requesting user was authorized to edit, and did no...

CVE-2026-77411

creationtimestamp| type| source ---|---|--- 2026-09-16 16:11:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjq6qwgz24 2026-09-16 18:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnprymag52n...

CVE-2026-90049

creationtimestamp| type| source ---|---|--- 2026-09-16 16:10:43+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjog5vsz2p 2026-09-16 17:40:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnoocmrev2r 2026-09-23 04:24:43+00:00| published-proof-of-concept|...

CVE-2026-90011

creationtimestamp| type| source ---|---|--- 2026-09-16 16:09:44+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjmn7sml2g 2026-09-16 16:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnluvetf72f...

CVE-2026-89990

creationtimestamp| type| source ---|---|--- 2026-09-16 16:09:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjmaqelp2w 2026-09-16 16:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnlusjap42r...

CVE-2026-89972

creationtimestamp| type| source ---|---|--- 2026-09-16 16:09:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjlys4g42n 2026-09-16 16:40:12+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnlcykoj32y...

CVE-2026-89916

creationtimestamp| type| source ---|---|--- 2026-09-16 16:08:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjkhjdsr2t 2026-09-16 16:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnk74yedu2g...

CVE-2026-89857

creationtimestamp| type| source ---|---|--- 2026-09-16 16:00:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnj3j3p6k2n 2026-09-16 16:07:59+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjjjeojs2f...

CVE-2026-89847

creationtimestamp| type| source ---|---|--- 2026-09-16 15:50:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnijo2qvo2y 2026-09-16 16:07:47+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjj4kchq2j...

CVE-2026-89846

creationtimestamp| type| source ---|---|--- 2026-09-16 15:50:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnijlo6su2b 2026-09-16 16:07:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjiugal72w...

keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.51.1-0.2.hum1 aarch64, x8664 syft-1.51.1-0.2.hum1.src src Security Fixes: syft: CVE-2026-88922...

CVE-2026-92565 Rallly before 4.15.0 Information Disclosure via polls.get

Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information...

CVE-2026-92395

creationtimestamp| type| source ---|---|--- 2026-09-16 14:38:26+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mvnejesvw22a 2026-09-16 16:11:55+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnjqkpjsk2r 2026-09-16 18:00:12+00:00| seen|...