CC
Üretici güvenlik profili
Concrete CMS
Ürün portföyü, yama kanıtları ve sömürü sinyalleri tek güvenlik karnesinde
Veriler CVE Programı, NVD, CISA KEV ve üretici güvenlik bültenlerinden birleştirilir.
Toplam CVE110
Kritik0
CISA KEV0
Public exploit3
Yama oranı%0
Ort. CVSS5.7
12 aylık açık hızı
0
0
0
0
0
0
44
1
0
0
65
0
CVE KEV
CVE önem dağılımı
110toplam CVE
Yüksek39 (35%)
Orta48 (44%)
Düşük23 (21%)
Yama ve sömürü görünümü
%0
Doğrulanmış yama
%0
CISA KEV
%3
Public exploit
0Yama var
0Kısmi
0Geçici çözüm
0Üretici: yama yok
110Bilinmiyor
Son güvenlik açıkları
6.3
CVE-2026-18120
Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data
CC
Yama durumu bilinmiyorEPSS %0
2.0
CVE-2026-85387
Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
CC
Yama durumu bilinmiyorEPSS %0
2.1
CVE-2026-87031
Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation
CC
Yama durumu bilinmiyorEPSS %0
5.3
CVE-2026-87028
Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields
CC
Yama durumu bilinmiyorEPSS %0
7.3
CVE-2026-85386
Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block
CC
Yama durumu bilinmiyorEPSS %0
7.7
CVE-2026-85385
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
CC
Yama durumu bilinmiyorEPSS %1
1.8
CVE-2026-81927
Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
CC
Yama durumu bilinmiyorEPSS %0
2.0
CVE-2026-18426
Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit
CC
Yama durumu bilinmiyorEPSS %0
2.0
CVE-2026-81926
Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog
CC
Yama durumu bilinmiyorEPSS %0
2.1
CVE-2026-81925
Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
CC
Yama durumu bilinmiyorEPSS %0