Concrete CMS Concrete CMS

• CVE-2026-68526 Medium 5.3 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller 0.1%
• CVE-2026-81913 Medium 5.3 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. 0.3%
• CVE-2026-81912 Medium 5.7 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature 0.2%
• CVE-2026-81911 Medium 5.8 Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description 0.2%
• CVE-2026-81910 Medium 5.9 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values 0.4%
• CVE-2026-81909 Medium 5.9 Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks 0.4%
• CVE-2026-68528 Medium 6.0 Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title 0.4%
• CVE-2026-18122 Medium 6.0 Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization 0.4%
• CVE-2026-81908 Medium 6.0 Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups 0.4%
• CVE-2026-81906 Medium 6.3 [UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks 0.6%
• CVE-2026-81905 Medium 6.3 Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another. 0.4%
• CVE-2026-18121 Medium 6.3 Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}). 0.5%
• CVE-2026-84432 Medium 5.3 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller 0.2%
• CVE-2026-68527 Medium 5.9 Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog 0.5%
• CVE-2026-81904 Medium 6.3 Concrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration 0.5%
• CVE-2026-10721 High 8.4 Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components 0.1%
• CVE-2026-7888 High 8.4 Concrete CMS below 9.5.3 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. 0.2%
• CVE-2026-8353 Low 2.1 Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme 0.1%
• CVE-2026-8347 Low 2.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog 0.2%
• CVE-2026-8340 Low 2.3 Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion 0.1%
• CVE-2026-8139 Low 2.0 Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName 0.1%
• CVE-2026-7890 Low 2.1 Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block 0.2%
• CVE-2026-8409 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete 0.1%
• CVE-2026-8410 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete 0.1%
• CVE-2026-8411 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete 0.1%
• CVE-2026-8412 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache 0.1%
• CVE-2026-8413 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design 0.1%
• CVE-2026-8414 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate 0.1%
• CVE-2026-8415 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder 0.1%
• CVE-2026-8416 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) 0.1%
• CVE-2026-8427 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) 0.1%
• CVE-2026-8432 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() 0.1%
• CVE-2026-8433 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() 0.1%
• CVE-2026-8434 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() 0.1%
• CVE-2026-8435 Low 2.3 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() 0.1%
• CVE-2026-7887 Low 2.3 For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status 0.2%
• CVE-2026-7886 Low 2.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter 0.3%
• CVE-2026-7882 Low 2.3 Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller 0.1%
• CVE-2026-8327 Medium 5.3 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. 0.2%
• CVE-2026-8245 Medium 6.0 Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection 0.1%
• CVE-2026-8337 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys 0.2%
• CVE-2026-8240 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure in Backend\SummaryTemplate 0.2%
• CVE-2026-7881 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block 0.2%
• CVE-2026-7879 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password() 0.2%
• CVE-2026-8238 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation message 0.2%
• CVE-2026-8237 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint 0.6%
• CVE-2026-8239 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating' 0.2%
• CVE-2026-8236 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID} 0.7%
• CVE-2026-8205 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar 0.2%
• CVE-2026-8204 Medium 6.3 Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog 0.2%