EUVD-2026-31354

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/messagepage' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and th...

CVE-2026-5252

The CVE-2026-5252 entry concerns z-9527 admin 1.0/2.0 with a vulnerability in the Message Create Endpoint. Specifically, manipulation of an as-yet-unknown function in /server/routes/message.js can cause cross-site scripting. The flaw is remotely exploitable and an exploit is publicly available. T...

PT-2025-16308 · Laravel +4 · Laravel +4

Name of the Vulnerable Software and Affected Versions: Aidex versions prior to 1.7 Description: The issue allows an authenticated malicious user to execute unauthorized commands within the system by exploiting an open registry. This can include executing operating system commands, interacting wit...

User can selectively turn on the fallback flag to take all ETH on the agent contract as layerzero fee refund

Lines of code Vulnerability details Impact performFallbackCall can revert sliently when refundee is not capable of taking ETH refund from layerzero side Proof of Concept In RootBridgeAgent.sol when the has fall back toggle flag is on, the smart contract aim to perform a fallback call to notify th...