Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,702All CVEsplus 19,141 rejected
- 647Last 24 hours3,003 in the last 7 days
- 17,172Last 30 days1,609 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 31 | 40 | 45 | 0 | 117 | 138 |
| 2025 | 0 | 0 | 3 | 1 | 0 | 4 | 21 |
| 2024 | 0 | 0 | 8 | 9 | 0 | 17 | 17 |
| Title | ||
|---|---|---|
| CVE-2026-18120 | Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry dataConcrete CMS · Concrete CMS | Medium6.3 |
| CVE-2026-85387 | Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API accessConcrete CMS · Concrete CMS | Low2.0 |
| CVE-2026-87031 | Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creationConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-87028 | Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary FieldsConcrete CMS · Concrete CMS | Medium5.3 |
| CVE-2026-85386 | Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form BlockConcrete CMS · Concrete CMS | High7.3 |
| CVE-2026-85385 | Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone FieldConcrete CMS · Concrete CMS | High7.7 |
| CVE-2026-81927 | Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization modeConcrete CMS · Concrete CMS | Low1.8 |
| CVE-2026-18426 | Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot editConcrete CMS · Concrete CMS | Low2.0 |
| CVE-2026-81926 | Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialogConcrete CMS · Concrete CMS | Low2.0 |
| CVE-2026-81925 | Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date FormatConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-18425 | IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pagesConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-18424 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different portsConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-18423 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search presConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-18422 | Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token ValidationConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-18421 | Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not controlConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-68529 | Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entriesConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-68530 | Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' InstancesConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-68531 | Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword SearchConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-81924 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template ActivationConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-81923 | Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editorConcrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-81922 | "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "Concrete CMS · Concrete CMS | Low2.1 |
| CVE-2026-81921 | In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account StatusConcrete CMS · Concrete CMS | Low2.3 |
| CVE-2026-81920 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset EndpointConcrete CMS · Concrete CMS | Low2.3 |
| CVE-2026-68532 | Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard ActionConcrete CMS · Concrete CMS | Low2.3 |
| CVE-2026-68533 | Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments PermissionConcrete CMS · Concrete CMS | Low2.3 |
| CVE-2026-68534 | Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectorsConcrete CMS · Concrete CMS | Low2.3 |
| CVE-2026-81919 | Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement EndpointConcrete CMS · Concrete CMS | Low2.3 |
| CVE-2026-81899 | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboardConcrete CMS · Concrete CMS | High7.3 |
| CVE-2026-18115 | In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.Concrete CMS · Concrete CMS | High7.4 |
| CVE-2026-18113 | Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page NamesConcrete CMS · Concrete CMS | High7.5 |
| CVE-2026-81898 | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association viewsConcrete CMS · Concrete CMS | High7.5 |
| CVE-2026-81897 | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_controlConcrete CMS · Concrete CMS | High7.7 |
| CVE-2026-81896 | Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question LabelConcrete CMS · Concrete CMS | High8.4 |
| CVE-2026-18111 | Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verificationConcrete CMS · Concrete CMS | High8.5 |
| CVE-2026-81895 | Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`Concrete CMS · Concrete CMS | High8.5 |
| CVE-2026-81894 | Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption fieldConcrete CMS · Concrete CMS | High8.5 |
| CVE-2026-18110 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, usernameConcrete CMS · Concrete CMS | High8.7 |
| CVE-2026-81900 | Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)Concrete CMS · Concrete CMS | High7.3 |
| CVE-2026-18116 | Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval NotificationsConcrete CMS · Concrete CMS | High7.3 |
| CVE-2026-18117 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias NameConcrete CMS · Concrete CMS | High7.3 |
| CVE-2026-81901 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpointConcrete CMS · Concrete CMS | High7.2 |
| CVE-2026-81902 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block CleanupConcrete CMS · Concrete CMS | High7.1 |
| CVE-2026-81903 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container iconConcrete CMS · Concrete CMS | High7.0 |
| CVE-2026-18119 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style valuesConcrete CMS · Concrete CMS | High7.0 |
| CVE-2026-81907 | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity recordsConcrete CMS · Concrete CMS | Medium6.1 |
| CVE-2026-81918 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display blockConcrete CMS · Concrete CMS | Medium4.8 |
| CVE-2026-81917 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tagsConcrete CMS · Concrete CMS | Medium5.1 |
| CVE-2026-68535 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissionsConcrete CMS · Concrete CMS | Medium5.1 |
| CVE-2026-81916 | Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized ObjectConcrete CMS · Concrete CMS | Medium5.1 |
| CVE-2026-81915 | In Concrete CMS below 9.5.3, Page Type update omits object-level authorizationConcrete CMS · Concrete CMS | Medium5.1 |