C
Vendor security profile
concretecms
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs87
Critical0
CISA KEV0
Public exploit3
Patch rate%0
Avg. CVSS5.8
12-month vulnerability rate
0
0
0
0
0
0
44
0
0
0
43
0
CVE KEV
CVE severity distribution
87toplam CVE
High33 (38%)
Medium38 (44%)
Low16 (18%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%3
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
87Unknown
Latest vulnerabilities
8.7
CVE-2026-95653
Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
C
Patch verifiedEPSS %1
8.6
CVE-2026-93659
Concrete CMS Community Store before 2.7.8 Stored XSS
C
Patch verifiedEPSS %0
6.3
CVE-2026-18120
Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data
CC
Patch status unknownEPSS %0
2.0
CVE-2026-85387
Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
CC
Patch status unknownEPSS %0
2.1
CVE-2026-87031
Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation
CC
Patch status unknownEPSS %0
5.3
CVE-2026-87028
Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields
CC
Patch status unknownEPSS %0
7.3
CVE-2026-85386
Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block
CC
Patch status unknownEPSS %0
7.7
CVE-2026-85385
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
CC
Patch status unknownEPSS %1
1.8
CVE-2026-81927
Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
CC
Patch status unknownEPSS %0
2.0
CVE-2026-18426
Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit
CC
Patch status unknownEPSS %0