PT-2026-89795

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

PT-2026-89744

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 16.0.4 Description Restricted API tokens can be used to gain unauthorized access to the "allow maintainer edit" feature. Recommendations Update to version 16.0.4 or later...

PT-2026-90499

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit page contents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

CVE-2026-84432

Concrete CMS versions 9 through 9.5.2 are affected by a CSRF vulnerability in the Boards custom slot dialog controller (custom_slot.php), specifically the saveTemplate() action. The action did not validate an anti-CSRF token, gating only on the canEditBoardContents() permission. A crafted cross-s...

CVE-2026-84432 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...

CVE-2026-68527

Concrete CMS 8.3.0 through 9.5.2 contains an authorization bypass (cross-calendar IDOR) in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog validated permissions against the calendar identifier supplied in the request rather than the calendar actually owning...

CVE-2026-68527 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-68527

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-68527 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

EUVD-2026-75673

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-68527 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-88959

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

PYSEC-2026-3825 django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

django CMS: Stored XSS in edit-mode plugin exception rendering

SummaryWhen plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's short...

CVE-2026-68527: Authorization Bypass Through User-Controlled Key

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-88959: Missing Authorization

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

PT-2026-89565

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/custom slot.php saveTemplate action. The action created a board slot proxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance...

Kibana 9.3.x < 9.4.3 Privilege Escalation (ESA-2026-61)

The version of Kibana installed on the remote host is 9.3.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-61 advisory. - Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control...

CVE-2026-78234 Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...

CVE-2026-78234

hawtio-operator in OpenShift contains a Service CA signing oracle flaw. The operator reads the Service CA private signing key from the openshift-service-ca namespace and mints client certificates whose Subject CN is taken directly from the author of a namespaced Hawtio custom resource. Because th...