Skip to content
Noroxi

tenzai

15 credited records · 15 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for tenzai

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits instantly.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-81926
    8Monitor

    Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

    LowCVSS 2.0No exploitEPSS 0%

    concretecms · concrete cmsSep 15, 2026

  • CVE-2026-81925
    8Monitor

    Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

    LowCVSS 2.1No exploitEPSS 0%

    concretecms · concrete cmsSep 15, 2026

  • CVE-2026-81919
    9Monitor

    Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint

    LowCVSS 2.3No exploitEPSS 0%

    concretecms · concrete cmsSep 15, 2026

  • CVE-2026-81898
    30Monitor

    Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

    HighCVSS 7.5No exploitEPSS 0%

    concrete cms · concrete cmsSep 15, 2026

  • CVE-2026-81897
    30Monitor

    Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control

    HighCVSS 7.7No exploitEPSS 0%

    concretecms · concrete cmsSep 15, 2026

  • CVE-2026-81896
    33Monitor

    Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label

    HighCVSS 8.4No exploitEPSS 0%

    concretecms · concrete cmsSep 15, 2026

  • CVE-2026-81894
    34Monitor

    Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field

    HighCVSS 8.5No exploitEPSS 0%

    concretecms · concrete cmsSep 15, 2026

  • CVE-2026-81902
    28Monitor

    Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup

    HighCVSS 7.1No exploitEPSS 0%

    concretecms · concrete cmsSep 14, 2026

  • CVE-2026-81901
    28Monitor

    Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

    HighCVSS 7.2No exploitEPSS 0%

    concretecms · concrete cmsSep 14, 2026

  • CVE-2026-81916
    20Monitor

    Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object

    MediumCVSS 5.1No exploitEPSS 0%

    concretecms · concrete cmsSep 11, 2026

  • CVE-2026-81910
    23Monitor

    Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

    MediumCVSS 5.9No exploitEPSS 0%

    concretecms · concrete cmsSep 11, 2026

  • CVE-2026-81909
    23Monitor

    Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-de

    MediumCVSS 5.9No exploitEPSS 0%

    concrete cms · concrete cmsSep 11, 2026

  • CVE-2026-81906
    25Monitor

    [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks

    MediumCVSS 6.3No exploitEPSS 0%

    concrete cms · concrete cmsSep 10, 2026

  • CVE-2026-81905
    25Monitor

    Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.

    MediumCVSS 6.3No exploitEPSS 0%

    concrete cms · concrete cmsSep 10, 2026

  • CVE-2026-81904
    25Monitor

    Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration

    MediumCVSS 6.3No exploitEPSS 0%

    concrete cms · concrete cmsSep 8, 2026