Low
CVE-2026-8415
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Low
CVE-2026-8414
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Low
CVE-2026-8411
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
Low
CVE-2026-8433
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()
Low
CVE-2026-8434
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()
Low
CVE-2026-8427
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)
Medium
CVE-2026-8237
Concrete CMS is vulnerable to IDOR
Medium
CVE-2026-8240
Concrete CMS is vulnerable to unauthenticated page metadata disclosure
Medium
CVE-2026-8238
Concrete CMS is vulnerable to IDOR
Low
CVE-2026-7886
Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage
Low
CVE-2026-8139
Concrete CMS is vulnerable to Stored XSS via external-link page cvName
Low
CVE-2026-7890
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation
Low
CVE-2026-7887
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status
Medium
CVE-2026-7881
Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block
Medium
CVE-2026-8236
Concrete CMS is vulnerable to IDOR combined with a missing authentication gate
Medium
CVE-2026-8239
Concrete CMS is vulnerable to IDOR
Medium
CVE-2026-8327
Concrete CMS has a session-hardening bypass and allows password change without reauthorization
Low
CVE-2026-7882
Concrete CMS is vulnerable to unauthorized file deletion
Medium
CVE-2026-7879
Concrete CMS has an unauthorized file access issue
Medium
CVE-2026-9271
KeepInMind - Dashboard Notes <= 0.8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-9269
Secure Copy Content Protection and Content Locking <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2026-46701
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Critical
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
Critical
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.