CLSA-2026-1789425190 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 6 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.9...

CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CLSA-2026-1789416166 TuxCare security update for org.springframework (12 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 12 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.5...

CLSA-2026-1789415531 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 4.18.7-p1+tuxcare...

CLSA-2026-1789415252 TuxCare security update for org.springframework.ldap (1 CVE)

TuxCare rebuilt 6 org.springframework.ldap packages to address 1 CVE. Fixed in 2.3.2.RELEASE-tuxcare.1...

CLSA-2026-1789414950 TuxCare security update for 82 packages (3 CVEs)

TuxCare rebuilt 82 packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3...

CVE-2026-82519

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

EUVD-2026-77771

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CVE-2026-82519

The Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check in the profile-page update handler. An authenticated low-privileged attacker can submit a crafted POST request omitting the two-factor-authentication field, which skips nonce verification and trigg...

CVE-2026-82519 Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

CLSA-2026-1789410116 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.8.16-tuxcare.15...

CVE-2026-90806

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

RLSA-2026:67308 Moderate: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

CLSA-2026-1789407656 TuxCare security update for log4j:log4j (2 CVEs)

TuxCare rebuilt log4j:log4j to address 2 CVEs. Fixed in 1.2.13-tuxcare.1...

CLSA-2026-1789407633 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.9...

CLSA-2026-1789407479 TuxCare security update for log4j:log4j (2 CVEs)

TuxCare rebuilt log4j:log4j to address 2 CVEs. Fixed in 1.2.12-tuxcare.1...

CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

CVE-2026-90806

CVE-2026-90806 is a missing authorization vulnerability in DjangoCRM django-crm (versions up to 1.2), specifically in the BulkUpdateCasesView function within backend/cases/bulk_views.py (component: Bulk Case Update). An attacker with low privileges can exploit this remotely without user interacti...

CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...