478372 matches found
CLSA-2026-1789425190 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 17 org.springframework packages to address 6 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.9...
CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint
In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...
CVE-2026-81901 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint
In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...
CLSA-2026-1789416166 TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 17 org.springframework packages to address 12 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.5...
CLSA-2026-1789415531 TuxCare security update for craftcms/cms (1 CVE)
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 4.18.7-p1+tuxcare...
CLSA-2026-1789415252 TuxCare security update for org.springframework.ldap (1 CVE)
TuxCare rebuilt 6 org.springframework.ldap packages to address 1 CVE. Fixed in 2.3.2.RELEASE-tuxcare.1...
CLSA-2026-1789414950 TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 59 org.springframework.boot packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3...
CVE-2026-82519
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...
CVE-2026-82519 Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...
EUVD-2026-77771
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...
CVE-2026-82519
The Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check in the profile-page update handler. An authenticated low-privileged attacker can submit a crafted POST request omitting the two-factor-authentication field, which skips nonce verification and trigg...
CLSA-2026-1789410116 TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.8.16-tuxcare.15...
CVE-2026-90806
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...
RLSA-2026:67308 Moderate: nginx:1.24 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...
CVE-2026-54176
backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits...
CLSA-2026-1789407656 TuxCare security update for log4j:log4j (2 CVEs)
TuxCare rebuilt log4j:log4j to address 2 CVEs. Fixed in 1.2.13-tuxcare.1...
CLSA-2026-1789407633 TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.12-tuxcare.9...
CLSA-2026-1789407479 TuxCare security update for log4j:log4j (2 CVEs)
TuxCare rebuilt log4j:log4j to address 2 CVEs. Fixed in 1.2.12-tuxcare.1...
CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...
EUVD-2026-77695
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...