Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations...
CVE-2026-8237
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns th
2026-05-23 归档
今日共收录 869 条安全情报，包含 93 个 CVE，394 篇安全通告，以及 104 篇研究论文。
← 返回归档列表Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and...
CVE-2026-8327
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across...
CVE-2026-8240
Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configur
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page...
CVE-2026-8238
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the
Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because...
CVE-2026-8139
Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExte
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[]...
CVE-2026-7886
Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lea
In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor...
CVE-2026-7890
In Concrete CMS 9.5.0 and below, the RSS Displayer block accepts a feed URL from any page editor and fetches it server-s
In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers...
CVE-2026-7879
In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php all
For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A...
CVE-2026-7887
For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0
Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express...
CVE-2026-7881
Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via
Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF...
CVE-2026-7882
Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the Del
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate....
CVE-2026-8236
Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating'...
CVE-2026-8239
Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms exist
Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper...
CVE-2026-4929
Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template...
CVE-2026-22678
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter...
CVE-2026-4093
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Ve
Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing...
CVE-2026-5091
Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions us
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
CVE-2026-46681
## Summary The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties wit
containerd user ID handling bypass allows runAsNonRoot evasion
CVE-2026-46680
### Impact A bug was found in containerd where containers launched with a numeric `User` directive that cannot be parsed
Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory
CVE-2026-46671
### Impact A maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary