CVE-2026-78210

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...

CVE-2026-81909

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...