CVE-2026-81922 "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81922 "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81922

Concrete CMS before 9.5.3 contains a missing authorization flaw in the sitemap Explore dashboard controller . The send_to_top and send_to_bottom reorder actions performed only a generic sitemap-access check before loading a page via the attacker-controlled cNodeID parameter and altering its displ...

CVE-2026-81922 "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-81922: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

PT-2026-92416

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An issue exists in the dashboard sitemap reorder action ConcreteControllerBackendDashboardSitemapUpdate where the system only verifies the global access sitemap task permission and fails to chec...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: padata: fixed UAF in padatareorder A bug was found when running the ltp test: BUG: KASAN: slab-use-after-free in padatafindnext+0x29/0x1a0 A read of size 4 at addr ffff88bbfe003524 was performed by task kworker/u113:2/3039206 CPU...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: padata: avoided UAF Use-After-Write for reorderwork. Although the previous patch can avoid UAFs related to ps and ps for doserial, it cannot prevent potential UAF issues related to reorderwork. This issue can occur as follows: c...

CVE-2026-54180: Authorization Bypass Through User-Controlled Key

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query inste...

CVE-2026-90496

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90496 Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90496 Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

EUVD-2026-76949

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

CVE-2026-90496

A SQL injection vulnerability exists in Fengoffice Feng Office versions up to 3.11.13.11 , affecting the update_system_module_order/update_dimension_order functions in the file application/controllers/MoreController.class.php (component: Reorder Handlers ). An authenticated attacker (high privile...

PT-2026-90788

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description An issue exists in the Reorder Handlers component within the file application/controllers/MoreController.class.php. A remote attacker can perform a SQL injection by manipulating t...

CVE-2026-90496: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function updatesystemmoduleorder/updatedimensionorder of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims result...

Linux Distros Unpatched Vulnerability : CVE-2026-80748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over...

SUSE CVE-2026-80748

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

CVE-2026-80748

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

UBUNTU-CVE-2026-80748

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...