Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation (CVE-2026-7890) | HOL Guard CVE