CVE-2026-7890

creationtimestamp| type| source ---|---|--- 2026-05-21 22:59:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmfjizqo2q2q...

CVE-2026-8327

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...

CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...

CVE-2026-8327

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...

CVE-2026-8327

Concrete CMS

CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...

CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...

CVE-2026-47114

creationtimestamp| type| source ---|---|--- 2026-05-21 21:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmfculcztd2l 2026-06-05 11:01:43+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mnjyezeuae22...

CVE-2026-48526

creationtimestamp| type| source ---|---|--- 2026-05-21 20:35:04+00:00| published-proof-of-concept| https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx 2026-05-28 17:38:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmwksx74os2e 2026-06-04 08:21:13+00:00|...

EUVD-2026-31340

Concrete CMS 9.5.0 and below emits a CSRF token in the localavailableupdate.php view $token-output'doupdate' but the corresponding doupdate method in concrete/controllers/singlepage/dashboard/system/update/update.php never calls $this-token-validate'doupdate'. The form is rendered as a POST form,...

CVE-2026-9133

creationtimestamp| type| source ---|---|--- 2026-05-21 19:54:16+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mmf75if6um2a...

CVE-2026-9114

creationtimestamp| type| source ---|---|--- 2026-05-21 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmf66sc66s2v 2026-05-25 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260526 2026-05-26 18:00:00+00:00| seen|...

CVE-2026-48239

creationtimestamp| type| source ---|---|--- 2026-05-21 19:12:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf4tno6jl2h...

CVE-2026-48243

creationtimestamp| type| source ---|---|--- 2026-05-21 18:55:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf3u2gu672i...

CVE-2026-48237

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frmticketid and frmrespid POST parameters are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to...

CVE-2026-48230

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdbimport.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the multiple POST parameters mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix,...

CVE-2026-48221

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmaddstr POST parameter directly into an HTML form hidden input value attribute...

CVE-2026-48220

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmaddstr POST parameter directly into an HTML form hidden input value attribute...

CVE-2026-48224

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmaddstr POST parameter directly into an HTML form hidden input value attribute...

CVE-2026-48218

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmname and frmid POST parameters directly into rendered HTML content a...