Concrete CMS vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 202417
3. 20254
4. 2026117

Newest CVEs

• CVE-2026-18120

  Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data

  Concrete CMS · Concrete CMS

  Medium6.3
• CVE-2026-85387

  Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access

  Concrete CMS · Concrete CMS

  Low2.0
• CVE-2026-87031

  Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation

  Concrete CMS · Concrete CMS

  Low2.1
• CVE-2026-87028

  Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields

  Concrete CMS · Concrete CMS

  Medium5.3
• CVE-2026-85386

  Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block

  Concrete CMS · Concrete CMS

  High7.3
• CVE-2026-85385

  Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field

  Concrete CMS · Concrete CMS

  High7.7
• CVE-2026-81927

  Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

  Concrete CMS · Concrete CMS

  Low1.8
• CVE-2026-18426

  Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit

  Concrete CMS · Concrete CMS

  Low2.0
• CVE-2026-81926

  Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog

  Concrete CMS · Concrete CMS

  Low2.0
• CVE-2026-81925

  Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

  Concrete CMS · Concrete CMS

  Low2.1