Concrete CMS Concrete CMS

• CVE-2026-18120 Medium 6.3 Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data 0.4%
• CVE-2026-85387 Low 2.0 Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access 0.3%
• CVE-2026-87031 Low 2.1 Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation 0.3%
• CVE-2026-87028 Medium 5.3 Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields 0.4%
• CVE-2026-85386 High 7.3 Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block 0.2%
• CVE-2026-85385 High 7.7 Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field 0.5%
• CVE-2026-81927 Low 1.8 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode 0.2%
• CVE-2026-18426 Low 2.0 Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit 0.3%
• CVE-2026-81926 Low 2.0 Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog 0.3%
• CVE-2026-81925 Low 2.1 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format 0.3%
• CVE-2026-18425 Low 2.1 IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages 0.2%
• CVE-2026-18424 Low 2.1 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports 0.2%
• CVE-2026-18423 Low 2.1 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres 0.4%
• CVE-2026-18422 Low 2.1 Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation 0.5%
• CVE-2026-18421 Low 2.1 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control 0.4%
• CVE-2026-68529 Low 2.1 Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries 0.4%
• CVE-2026-68530 Low 2.1 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances 0.5%
• CVE-2026-68531 Low 2.1 Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search 0.5%
• CVE-2026-81924 Low 2.1 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation 0.2%
• CVE-2026-81923 Low 2.1 Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor 0.3%
• CVE-2026-81922 Low 2.1 "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages " 0.3%
• CVE-2026-81921 Low 2.3 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status 0.2%
• CVE-2026-81920 Low 2.3 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint 0.2%
• CVE-2026-68532 Low 2.3 Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action 0.3%
• CVE-2026-68533 Low 2.3 Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission 0.4%
• CVE-2026-68534 Low 2.3 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors 0.6%
• CVE-2026-81919 Low 2.3 Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint 0.1%
• CVE-2026-81899 High 7.3 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard 0.5%
• CVE-2026-18115 High 7.4 In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover. 0.4%
• CVE-2026-18113 High 7.5 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names 0.5%
• CVE-2026-81898 High 7.5 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views 0.4%
• CVE-2026-81897 High 7.7 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control 0.2%
• CVE-2026-81896 High 8.4 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label 0.2%
• CVE-2026-18111 High 8.5 Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification 0.2%
• CVE-2026-81895 High 8.5 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any` 0.5%
• CVE-2026-81894 High 8.5 Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field 0.2%
• CVE-2026-18110 High 8.7 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username 1.6%
• CVE-2026-81900 High 7.3 Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight) 0.3%
• CVE-2026-18116 High 7.3 Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications 0.3%
• CVE-2026-18117 High 7.3 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name 0.1%
• CVE-2026-81901 High 7.2 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint 0.4%
• CVE-2026-81902 High 7.1 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup 0.2%
• CVE-2026-81903 High 7.0 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon 0.3%
• CVE-2026-18119 High 7.0 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values 0.5%
• CVE-2026-81907 Medium 6.1 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records 0.1%
• CVE-2026-81918 Medium 4.8 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block 0.3%
• CVE-2026-81917 Medium 5.1 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags 0.2%
• CVE-2026-68535 Medium 5.1 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions 0.2%
• CVE-2026-81916 Medium 5.1 Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object 0.3%
• CVE-2026-81915 Medium 5.1 In Concrete CMS below 9.5.3, Page Type update omits object-level authorization 0.3%