Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-8139Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvNamePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-7890Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer BlockPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8409Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/deletePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8410Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/deletePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8411Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/deletePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8412Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cachePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8413Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/designPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8414Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicatePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8415Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorderPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8416Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8427Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8432Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8433Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8434Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8435Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-7887For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account StatusPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-7886Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameterPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-7882Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controllerPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8327Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8245Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injectionPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8337Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveysPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8240Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplatePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-7881Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail blockPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-7879Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8238Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation messagePackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpointPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8239Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}Packagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8205Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendarPackagist · concrete5/concrete5 · fixed in 9.5.1
- CVE-2026-8204Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend DialogPackagist · concrete5/concrete5 · fixed in 9.5.1