Concretecms
141 CVEs tracked since 2014. Since Jul 2014, none of them reached CISA KEV.
Concretecms CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2014-07 | 2 | 0 |
| 2014-08 | null or fewer | |
| 2014-09 | null or fewer | |
| 2014-10 | null or fewer | |
| 2014-11 | null or fewer | |
| 2014-12 | null or fewer | |
| 2015-01 | 1 | 0 |
| 2015-02 | null or fewer | |
| 2015-03 | null or fewer | |
| 2015-04 | null or fewer | |
| 2015-05 | null or fewer | |
| 2015-06 | null or fewer | |
| 2015-07 | null or fewer | |
| 2015-08 | null or fewer | |
| 2015-09 | null or fewer | |
| 2015-10 | null or fewer | |
| 2015-11 | null or fewer | |
| 2015-12 | null or fewer | |
| 2016-01 | null or fewer | |
| 2016-02 | null or fewer | |
| 2016-03 | null or fewer | |
| 2016-04 | null or fewer | |
| 2016-05 | null or fewer | |
| 2016-06 | null or fewer | |
| 2016-07 | null or fewer | |
| 2016-08 | null or fewer | |
| 2016-09 | null or fewer | |
| 2016-10 | null or fewer | |
| 2016-11 | null or fewer | |
| 2016-12 | null or fewer | |
| 2017-01 | null or fewer | |
| 2017-02 | null or fewer | |
| 2017-03 | null or fewer | |
| 2017-04 | null or fewer | |
| 2017-05 | null or fewer | |
| 2017-06 | null or fewer | |
| 2017-07 | null or fewer | |
| 2017-08 | null or fewer | |
| 2017-09 | 2 | 0 |
| 2017-10 | null or fewer | |
| 2017-11 | null or fewer | |
| 2017-12 | null or fewer | |
| 2018-01 | null or fewer | |
| 2018-02 | null or fewer | |
| 2018-03 | null or fewer | |
| 2018-04 | null or fewer | |
| 2018-05 | null or fewer | |
| 2018-06 | null or fewer | |
| 2018-07 | null or fewer | |
| 2018-08 | null or fewer | |
| 2018-09 | null or fewer | |
| 2018-10 | null or fewer | |
| 2018-11 | null or fewer | |
| 2018-12 | null or fewer | |
| 2019-01 | null or fewer | |
| 2019-02 | null or fewer | |
| 2019-03 | null or fewer | |
| 2019-04 | null or fewer | |
| 2019-05 | null or fewer | |
| 2019-06 | null or fewer | |
| 2019-07 | null or fewer | |
| 2019-08 | null or fewer | |
| 2019-09 | null or fewer | |
| 2019-10 | null or fewer | |
| 2019-11 | null or fewer | |
| 2019-12 | null or fewer | |
| 2020-01 | null or fewer | |
| 2020-02 | null or fewer | |
| 2020-03 | null or fewer | |
| 2020-04 | null or fewer | |
| 2020-05 | null or fewer | |
| 2020-06 | null or fewer | |
| 2020-07 | null or fewer | |
| 2020-08 | null or fewer | |
| 2020-09 | null or fewer | |
| 2020-10 | null or fewer | |
| 2020-11 | null or fewer | |
| 2020-12 | null or fewer | |
| 2021-01 | null or fewer | |
| 2021-02 | null or fewer | |
| 2021-03 | null or fewer | |
| 2021-04 | null or fewer | |
| 2021-05 | null or fewer | |
| 2021-06 | null or fewer | |
| 2021-07 | null or fewer | |
| 2021-08 | null or fewer | |
| 2021-09 | 14 | 0 |
| 2021-10 | null or fewer | |
| 2021-11 | 7 | 0 |
| 2021-12 | null or fewer | |
| 2022-01 | null or fewer | |
| 2022-02 | null or fewer | |
| 2022-03 | null or fewer | |
| 2022-04 | null or fewer | |
| 2022-05 | null or fewer | |
| 2022-06 | 5 | 0 |
| 2022-07 | null or fewer | |
| 2022-08 | null or fewer | |
| 2022-09 | null or fewer | |
| 2022-10 | null or fewer | |
| 2022-11 | 12 | 0 |
| 2022-12 | null or fewer | |
| 2023-01 | null or fewer | |
| 2023-02 | null or fewer | |
| 2023-03 | null or fewer | |
| 2023-04 | 10 | 0 |
| 2023-05 | null or fewer | |
| 2023-06 | null or fewer | |
| 2023-07 | null or fewer | |
| 2023-08 | null or fewer | |
| 2023-09 | null or fewer | |
| 2023-10 | 7 | 0 |
| 2023-11 | null or fewer | |
| 2023-12 | 5 | 0 |
| 2024-01 | null or fewer | |
| 2024-02 | null or fewer | |
| 2024-03 | null or fewer | |
| 2024-04 | 5 | 0 |
| 2024-05 | null or fewer | |
| 2024-06 | null or fewer | |
| 2024-07 | null or fewer | |
| 2024-08 | 4 | 0 |
| 2024-09 | 4 | 0 |
| 2024-10 | null or fewer | |
| 2024-11 | null or fewer | |
| 2024-12 | null or fewer | |
| 2025-01 | null or fewer | |
| 2025-02 | null or fewer | |
| 2025-03 | null or fewer | |
| 2025-04 | null or fewer | |
| 2025-05 | null or fewer | |
| 2025-06 | null or fewer | |
| 2025-07 | null or fewer | |
| 2025-08 | null or fewer | |
| 2025-09 | null or fewer | |
| 2025-10 | null or fewer | |
| 2025-11 | null or fewer | |
| 2025-12 | null or fewer | |
| 2026-01 | null or fewer | |
| 2026-02 | null or fewer | |
| 2026-03 | 7 | 0 |
| 2026-04 | null or fewer | |
| 2026-05 | 36 | 0 |
| 2026-06 | null or fewer | |
| 2026-07 | null or fewer | |
| 2026-08 | null or fewer | |
| 2026-09 | 20 | 0 |
Products
The products that kept showing up in Concretecms's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Concretecms.
- CVE-2026-18120Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data5.9
- CVE-2026-85387Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access7.1
- CVE-2026-87031Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation2.7
- CVE-2026-87028Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields6.5
- CVE-2026-85386Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block6.1
- CVE-2026-85385Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field9.6
- CVE-2026-81927Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode5.4
- CVE-2026-18426Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit6.5
- CVE-2026-81926Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog6.1
- CVE-2026-81925Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format6.1
- CVE-2026-18425IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages2.7
- CVE-2026-18424Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports7.1
- CVE-2026-18423Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres7.1
- CVE-2026-18422Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation6.5
- CVE-2026-81924Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation6.5
The record
- Peak rank
- #32 in May 2026
- Busiest month shown
- May 2026, 36 CVEs
- Months with a KEV entry
- 0 since Jul 2014
- Monthly snapshots
- 16 since 2014