https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-117536/https://vulnfeed.org/cve/CVE-2026-117536/Tue, 27 Oct 2026 11:17:34 +0000REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.https://vulnfeed.org/cve/CVE-2026-117532/https://vulnfeed.org/cve/CVE-2026-117532/Tue, 27 Oct 2026 11:17:33 +0000REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.https://vulnfeed.org/cve/CVE-2026-116896/https://vulnfeed.org/cve/CVE-2026-116896/Tue, 27 Oct 2026 11:17:32 +0000REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.