← All credits
riodrwn
13 vulnerability records and advisories credit this contributor.
CVE-2026-18122
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization
CVE-2026-18121
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).
CVE-2026-73629
Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses