CVE-2026-18121 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...

CVE-2026-18121 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...

CVE-2026-18121 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass IDOR because the frontend calendar lightbox endpoint /ccm/calendar/viewevent/bID/occurrenceid does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the...

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

GHSA-W4V4-9RW7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

Traefik entrypoint header-name sanitization bypassed via request trailers

Summary Traefik's entrypoint defenses against spoofed trusted header names — aliasHeadersStrategy / underscoreHeadersStrategy in delete or reject mode, and the default forwardedHeaders stripping of client-supplied X-Forwarded- — scan req.Header only and never req.Trailer. An unauthenticated clien...

GHSA-V67P-PHPQ-FC8X Traefik entrypoint header-name sanitization bypassed via request trailers

Summary Traefik's entrypoint defenses against spoofed trusted header names — aliasHeadersStrategy / underscoreHeadersStrategy in delete or reject mode, and the default forwardedHeaders stripping of client-supplied X-Forwarded- — scan req.Header only and never req.Trailer. An unauthenticated clien...

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate Kerberos authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend...

GHSA-QQJF-53CJ-PWVV Traefik HTTP/3 Backend NTLM Connection Reuse

Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate Kerberos authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend...

GHSA-F52W-8J3H-J724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...

GHSA-486V-Q2WF-FP2R rclone: http backend forwards custom/auth headers to a different host on redirect

Vulnerability Details File: backend/http/http.go Lines: 285 client construction — no CheckRedirect, 505-510 addHeaders, writes configured secret headers onto every request, 533-534 / 700-701 / 782-785 f.httpClient.Doreq used by List/stat/download Root Cause The http backend lets a user attach...

rclone: http backend forwards custom/auth headers to a different host on redirect

Vulnerability Details File: backend/http/http.go Lines: 285 client construction — no CheckRedirect, 505-510 addHeaders, writes configured secret headers onto every request, 533-534 / 700-701 / 782-785 f.httpClient.Doreq used by List/stat/download Root Cause The http backend lets a user attach...

CVE-2025-14364

CVE-2025-14364 Demo Importer Plus Suscriptor autenticado → Administrador mediante la acción AJAXdo-reinstall 〔 1 〕 Vulnerabilidad Causa raíz: Ajax::handlerequest registra la acción AJAX demoimporterplus sin llamar a currentusercan. Cualquier suscriptor autenticado puede enviar...

GHSA-P6M2-R3W9-MPXW rclone local: crafted Range request against a translated symlink panics (DoS)

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

rclone local: crafted Range request against a translated symlink panics (DoS)

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

GHSA-XWWR-4H3P-R22C rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

GHSA-P569-5GJG-9CMJ rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

rclone: RC per-server auth-proxy bypass

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...