Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73948 | critical | 9.9 | No | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected... | 2026-09-21 |
| CVE-2026-73946 | critical | 9.1 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73945 | critical | 9.9 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-81925 | medium | 6.1 | No | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in refle... | 2026-09-21 |
| CVE-2026-18426 | medium | 6.5 | No | Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions,... | 2026-09-21 |
| CVE-2026-81926 | medium | 6.1 | No | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmati... | 2026-09-21 |
| CVE-2026-85385 | critical | 9.6 | No | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashbo... | 2026-09-21 |
| CVE-2026-85386 | medium | 6.1 | No | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploa... | 2026-09-21 |
| CVE-2026-86358 | high | 8.8 | No | Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker... | 2026-09-21 |
| CVE-2026-87028 | medium | 6.5 | No | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board i... | 2026-09-21 |
| CVE-2026-87031 | low | 2.7 | No | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Contr... | 2026-09-21 |
| CVE-2026-18120 | medium | 5.9 | No | Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpress... | 2026-09-21 |
| CVE-2026-85387 | high | 7.1 | No | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account th... | 2026-09-21 |
| CVE-2026-18425 | low | 2.7 | No | Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only... | 2026-09-21 |
| CVE-2026-18424 | high | 7.1 | No | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS... | 2026-09-21 |
| CVE-2026-18423 | high | 7.1 | No | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit... | 2026-09-21 |
| CVE-2026-18422 | medium | 6.5 | No | Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page... | 2026-09-21 |
| CVE-2026-81924 | medium | 6.5 | No | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard th... | 2026-09-21 |
| CVE-2026-18116 | medium | 6.1 | No | Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approva... | 2026-09-21 |
| CVE-2026-90828 | medium | 6.6 | No | A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible of the file ld/ldelf... | 2026-09-21 |