CVE Notifier

CVE-2026-84850 CWE-295 N/A

CVE-2026-84850

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with out…

cve.org Devolutions:Server 15 Sep 2026

CVE-2026-18421 CWE-862 N/A

Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and delete_data_source), which resolve a ConfiguredDataSou…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-69212 CWE-200 5.9

Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison…

cve.org http4s:http4s 15 Sep 2026

CVE-2026-90969 CWE-284 N/A

CVE-2026-90969

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the …

cve.org Devolutions:Server 15 Sep 2026

CVE-2026-68529 CWE-862 N/A

Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express en…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-69213 CWE-400 7.5

Http4s Ember HTTP/2: unbounded outbound frame queue

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by writeLoop. When the peer stops reading, an unauthenticated HT…

cve.org http4s:http4s 15 Sep 2026

CVE-2026-84048 CWE-284 N/A

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension…

cve.org joomgalleryfriends.net:JoomGallery · extension · for 15 Sep 2026

CVE-2026-90971 CWE-863 N/A

CVE-2026-90971

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or clo…

cve.org Devolutions:Server 15 Sep 2026

CVE-2026-68530 CWE-862 N/A

Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly fr…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-69214 CWE-384 6.8

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied th…

cve.org http4s:http4s 15 Sep 2026

CVE-2026-68531 CWE-405 N/A

Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher priv…

cve.org Concrete · CMS:Concrete · CMS 15 Sep 2026

CVE-2026-69201 CWE-22 5.9

Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots.…

cve.org http4s:http4s 15 Sep 2026