CVE-2026-68527: Authorization Bypass Through User-Controlled Key

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-12907

creationtimestamp| type| source ---|---|--- 2026-07-16 08:05:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqrntt7kw2o...

CVE-2026-49213

creationtimestamp| type| source ---|---|--- 2026-07-11 12:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqemh2jf552m...

CVE-2026-14191

creationtimestamp| type| source ---|---|--- 2026-07-01 05:01:30+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpkqeufzqj27 2026-07-02 01:05:20+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpmtnhgzbd2h 2026-07-02 13:09:39+00:00| seen|...

CVE-2026-50083

creationtimestamp| type| source ---|---|--- 2026-06-12 18:07:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4dg3cyib2f...

CVE-2026-4549

creationtimestamp| type| source ---|---|--- 2026-06-05 05:59:14+00:00| seen| https://bsky.app/profile/blackhatnews.tokyo/post/3mnjhi4skj32s...

CVE-2026-10863

CVE-2026-10863 affects the correlations over-correlation endpoint in the application, specifically the overCorrelations() function in app/Controller/CorrelationsController.php. The vulnerability arises from accepting an order parameter from user-controlled named request parameters, which could al...

EUVD-2026-34265

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value wa...

CVE-2026-4125

creationtimestamp| type| source ---|---|--- 2026-04-25 22:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mke3vkobu22i...

Cross-site Scripting (XSS)

Overview @holoviz/panel is a The powerful data exploration & web app framework for Python. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the formatError function in panel/models/util.ts due to using String.replace without the global flag when escaping HTML...

CVE-2026-33492

creationtimestamp| type| source ---|---|--- 2026-03-23 16:47:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhqj6vlq2q2p 2026-03-25 04:00:14+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhu7b2y2nh27...

CVE-2026-32232

creationtimestamp| type| source ---|---|--- 2026-03-11 17:24:36+00:00| published-proof-of-concept| https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-2m67-cxxq-c3h8 2026-03-12 21:35:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgve5dqzr72u...

CVE-2026-25924

creationtimestamp| type| source ---|---|--- 2026-02-12 07:17:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3menh5jled224...

The vulnerability of the drm_fb_helper_damage() function in the drivers/gpu/drm/drm_fb_helper.c file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the drmfbhelperdamage function in the drivers/gpu/drm/drmfbhelper.c file of the Direct Rendering Infrastructure DRI driver for the Linux operating system is related to a single-occurrence offset error. Exploiting this vulnerability could allow an attacker to cause a service...

UBUNTU-CVE-2025-67125

A signed integer overflow in docopt.cpp v0.6.2 LeafPattern::match in docoptprivate.h when merging occurrence counters e.g., default LONGMAX + first user "-v/--verbose" can cause counter wrap negative/unbounded semantics and lead to logic/policy bypass in applications that rely on occurrence-based...

CVE-2025-67125

A signed integer overflow in docopt.cpp v0.6.2 LeafPattern::match in docoptprivate.h when merging occurrence counters e.g., default LONGMAX + first user "-v/--verbose" can cause counter wrap negative/unbounded semantics and lead to logic/policy bypass in applications that rely on occurrence-based...

CVE-2025-67125

A signed integer overflow in docopt.cpp v0.6.2 LeafPattern::match in docoptprivate.h when merging occurrence counters e.g., default LONGMAX + first user "-v/--verbose" can cause counter wrap negative/unbounded semantics and lead to logic/policy bypass in applications that rely on occurrence-based...

CVE-2025-67125

A signed integer overflow in docopt.cpp v0.6.2 LeafPattern::match in docoptprivate.h when merging occurrence counters e.g., default LONGMAX + first user "-v/--verbose" can cause counter wrap negative/unbounded semantics and lead to logic/policy bypass in applications that rely on occurrence-based...

EUVD-2026-4094

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Depot depot allows PHP Local File Inclusion.This issue affects Depot: from n/a through = 1.16...

CVE-2026-23724

CVE-2026-23724 affects the WeGIA web manager. A Stored Cross‑Site Scripting (XSS) vulnerability exists in the html/atendido/cadastro_ocorrencia.php endpoint where user-controlled data is rendered in the “Atendido” dropdown without sanitization. This could allow injection in Attendido_idatendido f...