EUVD-2026-79143

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...

CVE-2026-68534 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...

CVE-2026-68534

Concrete CMS before 9.5.3 contained a stored cross-site scripting (XSS) vulnerability caused by Express entry labels being rendered as raw HTML in association selectors. An unauthenticated attacker could submit a malicious payload through a public Express Form, which would then execute in an admi...

CVE-2026-21587

creationtimestamp| type| source ---|---|--- 2026-09-15 17:17:55+00:00| seen| https://bsky.app/profile/suriq.io/post/3mvl4xmx3vb2g...

CVE-2026-78225

creationtimestamp| type| source ---|---|--- 2026-09-15 16:15:50+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-02 2026-09-16 04:07:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvmbbxn7xj24 2026-09-16 08:10:04+00:00| seen|...

CVE-2026-84534

creationtimestamp| type| source ---|---|--- 2026-09-15 04:49:55+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260915 2026-09-15 20:50:29+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19 2026-09-16 22:01:06+00:00|...

CVE-2026-43785

creationtimestamp| type| source ---|---|--- 2026-09-15 04:46:21+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260915 2026-09-15 20:48:03+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19 2026-09-16 22:01:29+00:00|...

EUVD-2026-78209

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

EUVD-2026-78213

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...

CVE-2026-68534: Improper Neutralization of Input During Web Page Generation

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...

CVE-2026-90969: Improper Access Control

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...

PT-2026-92410

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.2.17 Description Improper access control in the vault entry listing feature allows an authenticated user who does not have the view-password permission to obtain cleartext passwords. This is achieved b...

PT-2026-92376

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...

CVE-2026-91200

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-75944

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...

CVE-2026-75944

CVE-2026-75944 is a race condition in Arista EOS 802.1X supplicant re-authentication that may leave a stale ACL entry in the system. If the AclAgent subsequently restarts, the stale entry can be applied to new supplicants, causing incorrect access control enforcement. The vulnerability requires 8...

CVE-2026-75944 A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...

rsync: rsync: Information disclosure and denial of service via crafted files-from entry

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

rsync: rsync: Information disclosure and denial of service via crafted files-from entry

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

CVE-2026-90942

creationtimestamp| type| source ---|---|--- 2026-09-14 18:40:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvir3pm7j72g 2026-09-14 20:08:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvivzb3opi2p 2026-09-14 21:11:25+00:00| seen|...