CVE-2026-66372 Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space...

CVE-2026-66372

CVE-2026-66372 affects the Digital Watchdog VMAX DVR and NVR product lineups. The root cause is a predictable seed in the pseudo-random number generator (PRNG) , resulting in insufficiently random values that make web session tokens predictable and bound their entropy to the seed space. The CVSS ...

CVE-2026-81925

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-18425

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-18426

Concrete CMS versions 9.0.0 through 9.5.2 are affected by a missing authorization flaw in the Express Form block . Control-management actions (add, modify, delete) relied solely on CSRF token validation, but the token is bound only to the user and action—not to a specific block, page, or form. Th...

EUVD-2026-79942

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-18426 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-18426 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-18426 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

Exploit for Improper Authentication in Jfrog Artifactory

CVE‑2026‑82329 – JFrog Artifactory Auth B...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

CVE-2026-81925

Concrete CMS versions before 9.5.3 contain a reflected cross-site scripting (XSS) vulnerability in the conversation view endpoint . A user-supplied custom date format was improperly neutralized when rendering conversation messages, allowing an attacker to execute arbitrary JavaScript in a victim'...

CVE-2026-18422

Concrete CMS before 9.5.3 is vulnerable in the multilingual page assignment backend action (Backend\Page\Multilingual::assign), where a destination-side authorization check and a CSRF token validation were both missing. An authenticated user holding only the Edit Page Multilingual Settings permis...

CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

CVE-2026-18422 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

EUVD-2026-79198

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...

CVE-2026-76672

CVE-2026-76672 affects the HPE Networking EdgeConnect SD-WAN Orchestrator . An authenticated remote attacker holding only read-only privileges can send a specially crafted request to the cache synchronization endpoint , leading to disclosure of sensitive third-party API tokens and credentials. Su...

CVE-2026-82190

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...

CVE-2026-81921

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...