Login Request a demo
CC
Product
Concrete Cms
by Concretecms · last CVE Sep 16, 2026
198
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities198In the news0Timeline
Severity mix
Critical 8High 46Medium 136Low 5
Severity
All severities198Critical8High46Medium136Low5
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Concrete Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-28473
3.3
1%
Apr 28
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section
Affected: before 9.2.0
CVE-2026-87031
2.7
0%
Sep 16
Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation
Affected: 9.2.0 before 9.5.3
CVE-2026-18425
2.7
0%
Sep 15
IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages
Affected: 9.0.0 before 9.5.3
CVE-2026-81923
2.7
0%
Sep 15
Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor
Affected: before 9.5.3
CVE-2026-81922
2.7
0%
Sep 15
"In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "
Affected: before 9.5.3
Showing 5