CLSA-2026-1773188141 TuxCare security update for extend (1 CVE)

TuxCare rebuilt extend to address 1 CVE. Fixed in 3.0.0-tuxcare.3...

CVE-2026-8417 Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/doupdate/. The doupdate method in concrete/controllers/singlepage/dashboard/extend/update.php checks only canInstallPackages before executing upgradeCoreData and upgrade on the named...