Authorization Bypass Through User-Controlled Key

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the exEntryID parameter in the Express Entry Detail block. An attacker can gain unauthorized access to all Express form submissions...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization via the /ccm/system/dialogs/file/usage/fID endpoint. An attacker can access internal site structure data, including page IDs, versions, and URL paths, by sending ...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the DeleteFile controller process. An attacker can trigger unauthorized file deletions by inducing a user with permission to edit conversation...

Authorization Bypass Through User-Controlled Key

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the AddMessage and UpdateMessage process via the attachments parameter. An attacker can bypass file permission restrictions by...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization in the submitpassword process. An attacker can gain unauthorized access to files by bypassing permission checks when downloading files, including those protected ...

Access Control Bypass

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Access Control Bypass via the summary template process. An attacker can obtain sensitive metadata, including title, path, description, and author information of private, draft, and...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization via the /ccm/frontend/conversations/messagepage endpoint. An attacker can access the full content of any conversation message, including those from restricted...

Unity Linux 20.1060e / 20.1070e Security Update: rubygem-addressable (UTSA-2026-016622)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016622 advisory. Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability...

PT-2026-53087

Name of the Vulnerable Software and Affected Versions nghttp2 nghttpx versions prior to 1.69.0 Description The nghttpx proxy forwards HTTP/1.1 Upgrade requests that contain a Content-Length header and body onto reusable keep-alive backend connections. During this process, it re-adds the Upgrade a...

Unity Linux 20.1060e / 20.1070e Security Update: grafana (UTSA-2026-016609)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016609 advisory. Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: xmlgraphics-commons (UTSA-2026-016739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016739 advisory. Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a...

PT-2026-42754

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11 Description Insecure XML parser configuration in the WS-Transfer module may allow attackers to perform XML External Entity XXE attacks. X...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-nokogiri (UTSA-2026-016636)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016636 advisory. Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parse...

PT-2026-42845

Name of the Vulnerable Software and Affected Versions RT versions prior to 5.0.10 RT versions 6.0.0 through 6.0.2 Description An authentication bypass exists in installations using LDAP/AD for user authentication. Under specific LDAP server configurations, an attacker can authenticate as any...

PT-2026-42755

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11 Description An LDAP injection issue exists in the LDAP Certificate repository of the XKMS server. This allows an attacker to retrieve...

PT-2026-42753

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11 Description An incomplete fix for a previous issue allows for remote code execution if untrusted users are permitted to configure the Jav...

Unity Linux 20.1070e Security Update: xstream (UTSA-2026-016761)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016761 advisory. XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-nokogiri (UTSA-2026-016661)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016661 advisory. Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE...

Linux Distros Unpatched Vulnerability : CVE-2026-32312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: datanucleus-core (UTSA-2026-016737)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016737 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...