PT-2026-92180

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Stored Cross-Site Scripting XSS is possible in Express association views due to the Address attribute's country-less text formatter skipping HTML-escaping. This occurs when a non-required Addres...

PT-2026-92400

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced search method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: ena: Fixed incorrect descriptor freeing behavior. ENA has two types of TX queues: - Queues that only process TX packets arriving from the network stack. - Queues that only process TX packets forwarded to them by XDPREDIRECT ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: nvme: Fixed a multipath crash caused by the flush request when blktrace is enabled. The flush request initialized by blkkickflush has a NULL bio. This issue may be addressed during the nvmeendreq operation during io completion...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: MIPS: Octeon – Add PCIe link status check The standard PCIe configuration read-write interface is used to access the configuration space of peripheral PCIe devices in the mips processor. After the PCIe link becomes unavailable, i...

Astra Linux – Vulnerability in node-qs

The qs format used before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process to hang for an Express application. This is because the proto key can be exploited. In many typical Express use cases, an unauthenticated remote attacker can insert the...

Astra Linux – Vulnerability in Qemu

A reentry vulnerability was identified in the NVM Express Controller NVME emulation in QEMU. This CVE is similar to CVE-2021-3750. Just like in that case, when the reentry trigger causes the nvmectrlreset function to be called, data structures will be freed, leading to a use-after-free issue. A...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A flaw was discovered in the Linux kernel. A denial-of-service attack may occur if a consecutive request for NVMEIOCTLRESET and NVMEIOCTLSUBSYSRESET is made through the device file of the driver, resulting in a disconnection of the PCIe link...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: phy: ralink: mt7621-pci: add sentinel to quirks table By fixing socdevattr to register the SOC as a device, the kernel will encounter an OOPs error in socdevicematchattr. This quirks test was introduced in the staging driver in t...

CVE-2026-81907

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81907

Concrete CMS version 9.5.2 and below is vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries). The root cause is that the controller records but fails to enforce a failed CSRF token che...

CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81907

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

EUVD-2026-76691

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81916

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

CVE-2026-81916

Concrete CMS before 9.5.3 contains an authorization bypass in the Express entry submission flow. The dashboard submit route resolved the target entity from an attacker-controlled route ID, while the permission check validated the independently posted form's entity — the two were never compared. A...

CVE-2026-81916 Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...

CVE-2026-81916 Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Expres...