https://vulnerability.circl.lu/sightings/feed 2026-09-19T07:12:34.273690+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/90c925dc-2b5c-41b7-a169-6565c05080a2/export 2026-09-19T07:12:34.289499+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "90c925dc-2b5c-41b7-a169-6565c05080a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81900", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvkngsrlxi2t", "content": "CVE-2026-81900 - concrete cms\nIn versions of Concrete CMS before 9.5.3, the YouTube block did not properly clean the width and height values it stored. A user who can edit blocks could insert malicious code that\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#concretecms #CVE #infosec", "creation_timestamp": "2026-09-15T12:40:04.826228Z"} 2026-09-15T12:40:04.826228+00:00 https://vulnerability.circl.lu/sighting/09e9b698-d07f-46f8-b256-c080c602e777/export 2026-09-19T07:12:34.292134+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "09e9b698-d07f-46f8-b256-c080c602e777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81907", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvd2wcaomh2t", "content": "CVE-2026-81907 - concrete cms\nVersions of Concrete CMS up to 9.5.2 let a malicious website trick a logged\u2011in administrator into deleting all records from a chosen data collection. The problem occurs because the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#concretecms #CVE #infosec", "creation_timestamp": "2026-09-12T12:20:05.332942Z"} 2026-09-12T12:20:05.332942+00:00 https://vulnerability.circl.lu/sighting/56965e0f-9b13-4162-b815-c7c7ed1fa8ee/export 2026-09-19T07:12:34.292270+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "56965e0f-9b13-4162-b815-c7c7ed1fa8ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81908", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7sz63vg42eztk", "content": "CVE-2026-81908 - Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups\nCVE ID : CVE-2026-81908\n \n Published : Sept. 11, 2026, 5:09 p.m. | 35\u00a0minutes ago\n \n Description : Concrete CMS 9.2.0 to 9.5.2...", "creation_timestamp": "2026-09-11T17:50:00.298774Z"} 2026-09-11T17:50:00.298774+00:00 https://vulnerability.circl.lu/sighting/6c2f9e7b-b99a-43df-a839-56732b4db394/export 2026-09-19T07:12:34.292385+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6c2f9e7b-b99a-43df-a839-56732b4db394", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81906", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bf25zvsv4hp4y", "content": "CVE-2026-81906 - [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks\nCVE ID : CVE-2026-81906\n \n Published : Sept. 10, 2026, 11:20 p.m. | 20\u00a0minutes ago\n \n Description : Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an acc...", "creation_timestamp": "2026-09-11T00:10:57.516701Z"} 2026-09-11T00:10:57.516701+00:00 https://vulnerability.circl.lu/sighting/17515e30-70a3-4f23-88ae-33bab3ef7e06/export 2026-09-19T07:12:34.292499+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "17515e30-70a3-4f23-88ae-33bab3ef7e06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81905", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/abzc7vl53hro3", "content": "CVE-2026-81905 - Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.\nCVE ID : CVE-2026-81905\n \n Published : Sept. 10, 2026, 11:16 p.m. | 24\u00a0minutes ago\n \n Description : Concrete CMS be...", "creation_timestamp": "2026-09-10T23:56:56.668219Z"} 2026-09-10T23:56:56.668219+00:00