EUVD-2026-79287

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-81921

Concrete CMS versions 8.5.3 through 9.5.2 are affected by an OAuth 2.0 refresh-token grant flaw. The unmodified upstream League grant issued new access tokens from a valid refresh token without re-checking the associated account's active status . Consequently, a user who obtained a refresh token ...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-81920

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list (concrete.seo.exclude_words) without validating the anti-CSRF token or restricting the reques...

CVE-2026-81920 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

CVE-2026-81920 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

EUVD-2026-79026

Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type. The Concrete...

Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9rg3-v78m-26q8. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fail...

GHSA-PHPH-C358-5MWM Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9rg3-v78m-26q8. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fail...

GHSA-VCGV-7RVM-M3VP Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfxw-3x8p-2vjr. This link is maintained to preserve external references. Original Description Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints...

Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfxw-3x8p-2vjr. This link is maintained to preserve external references. Original Description Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints...

CVE-2026-81919 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...

EUVD-2026-79142

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...

CVE-2026-81919 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...

CVE-2026-81919

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no CSRF token check , and its route accepted an...

CVE-2026-81919 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint the arrange action of Concrete\Controller\Backend\Page\ArrangeBlocks. The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method, so an...

CVE-2026-54547

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

CVE-2026-39039

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...