PT-2026-94068

Name of the Vulnerable Software and Affected Versions Uber Kraken versions 0.1.0 through 0.1.29 Description An issue exists where the application fails to validate the tag parameter in the '/tags/tag' endpoint. This allows unauthenticated attackers to perform directory traversal by using...

CVE-2026-88743

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

CVE-2026-81923

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

CVE-2026-81923

Concrete CMS versions before 9.5.3 are affected by a missing authorization check in the SEO Bulk Update Meta Tags editor . The saveRecord() action validated the per-page CSRF token but never called canEditPageProperties(), allowing a user with access to the bulk SEO tool and view-only permission ...

CVE-2026-81923 Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

EUVD-2026-79294

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

CVE-2026-81923 Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

CVE-2026-81923 Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

CVE-2026-53954

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer...

CVE-2026-53954

Bugsink , a self-hosted error tracking tool, is vulnerable to a temporary denial of service in versions prior to 2.2.2 . An attacker possessing a valid project DSN can submit an event with an unusually large number of custom tags, forcing excessive tag-row writes. Because Bugsink uses a single-wr...

CVE-2026-53954 Bugsink: DOS using large numbers of event tags

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer...

CVE-2026-53954 Bugsink: DOS using large numbers of event tags

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer...

CVE-2026-53954 Bugsink: DOS using large numbers of event tags

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer...

CVE-2026-88743: Improper Neutralization of Input During Web Page Generation

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

EUVD-2026-79297

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

CVE-2026-81567: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...

PT-2026-92471

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

PT-2026-92394

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...

CVE-2026-88743

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

CVE-2026-81923: Missing Authorization

In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord action validated the per-page CSRF token but never called canEditPageProperties for the target page, so a user who was granted access to the bulk SEO tool and...