Baja
CVE-2026-8410
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.039
Restablecer filtros
Baja
CVE-2026-8415
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder
Baja
CVE-2026-8414
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Baja
CVE-2026-8411
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
Baja
CVE-2026-8433
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()
Baja
CVE-2026-8434
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()
Baja
CVE-2026-8427
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)
Media
CVE-2026-8237
Concrete CMS is vulnerable to IDOR
Media
CVE-2026-8240
Concrete CMS is vulnerable to unauthenticated page metadata disclosure
Media
CVE-2026-8238
Concrete CMS is vulnerable to IDOR
Baja
CVE-2026-7886
Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage
Baja
CVE-2026-8139
Concrete CMS is vulnerable to Stored XSS via external-link page cvName
Baja
CVE-2026-7890
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation
Baja
CVE-2026-7887
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status
Media
CVE-2026-7881
Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block
Media
CVE-2026-8236
Concrete CMS is vulnerable to IDOR combined with a missing authentication gate
Media
CVE-2026-8239
Concrete CMS is vulnerable to IDOR
Media
CVE-2026-8327
Concrete CMS has a session-hardening bypass and allows password change without reauthorization
Baja
CVE-2026-7882
Concrete CMS is vulnerable to unauthorized file deletion
Media
CVE-2026-7879
Concrete CMS has an unauthorized file access issue
Alta
CVE-2026-46640
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
Alta
CVE-2026-46639
Twig: Sandbox property and method bypass via object-destructuring assignment
Alta
CVE-2026-8417
Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>`
Alta
CVE-2026-8426
Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.