CVE-2026-8414

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

CVE-2026-8414 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

CVE-2026-8205

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

CVE-2026-8205 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

EUVD-2026-31351

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

CVE-2026-8205 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar

Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since actiongetevents does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with...

CVE-2026-8204

Concrete CMS 9.5.0 and earlier versions are vulnerable to an authorization bypass in the Calendar Event Frontend Dialog, enabling potential cross-calendar data disclosure. A public calendar block can be used as a pivot to access private calendar data. The CVSS v4.0 base score is 6.3 (AV:N/AC:L/AT...

CVE-2026-48239

creationtimestamp| type| source ---|---|--- 2026-05-21 19:12:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf4tno6jl2h...

CVE-2026-48244

creationtimestamp| type| source ---|---|--- 2026-05-21 18:57:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmf3y6tqux2e...

CVE-2026-43497

creationtimestamp| type| source ---|---|--- 2026-05-21 16:17:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmesyzrc762t 2026-07-06 06:15:06+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...

CVE-2026-43494

creationtimestamp| type| source ---|---|--- 2026-05-21 12:56:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmehrqrwq72k 2026-05-22 08:21:59+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mmgiweecrly2 2026-05-25 08:00:04+00:00| seen|...

CVE-2026-99999

creationtimestamp| type| source ---|---|--- 2026-05-21 12:44:45+00:00| seen| https://bsky.app/profile/gonzokata.bsky.social/post/3mmeh53pwfk22 2026-06-19 12:04:49+00:00| seen| https://gist.github.com/shweta-tripathi-1519/c957e66dd8f0e7892e135a18982c486a...

CVE-2026-44073

creationtimestamp| type| source ---|---|--- 2026-05-21 10:43:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmeafaskb32i 2026-06-01 00:01:29+00:00| seen| https://bsky.app/profile/slackers.it/post/3mn6rmqdab727...

CVE-2026-38765

creationtimestamp| type| source ---|---|--- 2026-05-21 09:00:04+00:00| seen| Telegram/vpOabQVvb76izlIWt2pzp7PU5zl-D7jeeGQcHuuxEyFlkWM...

CVE-2026-6452

creationtimestamp| type| source ---|---|--- 2026-05-21 07:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmdvofn2xr2s...

CVE-2020-13435

creationtimestamp| type| source ---|---|--- 2026-05-21 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03...

CVE-2020-13631

creationtimestamp| type| source ---|---|--- 2026-05-21 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03...

MAL-2026-4549 Malicious code in dot-utils-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3091b9bb8cbf714d9391a59f7303a3748e183bbdf0fba2264b7496a2072e717f On every import, dist/index.js base64-decodes a hardcoded AES-256-CBC ciphertext, derives a key from environment variable VITEDOTUTILSAESSECRET,...

PT-2026-42570

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.4.x Description Cross Site Request Forgery CSRF occurs at the 'concrete/controllers/dialog/event/duplicate' endpoint. CSRF is a flaw that allows an attacker to trick a victim into performing actions they d...

Concrete CMS 安全漏洞

Concrete CMS is an open-source content management system designed for teams. Concrete CMS versions 9.5.0 and earlier have a security vulnerability that stems from an authorization bypass in the calendar event front-end dialog box. This vulnerability could lead to cross-calendar data leaks...