# Concrete CMS. Every CVE that names Concrete CMS among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data](https://agentprime.io/advisories/CVE-2026-18120.md) `CVE-2026-18120` · CVE record: Concrete CMS Concrete CMS · CVSS 6.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access](https://agentprime.io/advisories/CVE-2026-85387.md) `CVE-2026-85387` · CVE record: Concrete CMS Concrete CMS · CVSS 2.0 Low · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass - [Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation](https://agentprime.io/advisories/CVE-2026-87031.md) `CVE-2026-87031` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields](https://agentprime.io/advisories/CVE-2026-87028.md) `CVE-2026-87028` · CVE record: Concrete CMS Concrete CMS · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control - [Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block](https://agentprime.io/advisories/CVE-2026-85386.md) `CVE-2026-85386` · CVE record: Concrete CMS Concrete CMS · CVSS 7.3 High · Not analysed yet · Published 16 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field](https://agentprime.io/advisories/CVE-2026-85385.md) `CVE-2026-85385` · CVE record: Concrete CMS Concrete CMS · CVSS 7.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode](https://agentprime.io/advisories/CVE-2026-81927.md) `CVE-2026-81927` · CVE record: Concrete CMS Concrete CMS · CVSS 1.8 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit](https://agentprime.io/advisories/CVE-2026-18426.md) `CVE-2026-18426` · CVE record: Concrete CMS Concrete CMS · CVSS 2.0 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog](https://agentprime.io/advisories/CVE-2026-81926.md) `CVE-2026-81926` · CVE record: Concrete CMS Concrete CMS · CVSS 2.0 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format](https://agentprime.io/advisories/CVE-2026-81925.md) `CVE-2026-81925` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages](https://agentprime.io/advisories/CVE-2026-18425.md) `CVE-2026-18425` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site request forgery (CSRF), Broken access control - [Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports](https://agentprime.io/advisories/CVE-2026-18424.md) `CVE-2026-18424` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on…](https://agentprime.io/advisories/CVE-2026-18423.md) `CVE-2026-18423` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation](https://agentprime.io/advisories/CVE-2026-18422.md) `CVE-2026-18422` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not contr…](https://agentprime.io/advisories/CVE-2026-18421.md) `CVE-2026-18421` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries](https://agentprime.io/advisories/CVE-2026-68529.md) `CVE-2026-68529` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances](https://agentprime.io/advisories/CVE-2026-68530.md) `CVE-2026-68530` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search](https://agentprime.io/advisories/CVE-2026-68531.md) `CVE-2026-68531` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-405 - [Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation](https://agentprime.io/advisories/CVE-2026-81924.md) `CVE-2026-81924` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor](https://agentprime.io/advisories/CVE-2026-81923.md) `CVE-2026-81923` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - ["In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "](https://agentprime.io/advisories/CVE-2026-81922.md) `CVE-2026-81922` · CVE record: Concrete CMS Concrete CMS · CVSS 2.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status](https://agentprime.io/advisories/CVE-2026-81921.md) `CVE-2026-81921` · CVE record: Concrete CMS Concrete CMS · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint](https://agentprime.io/advisories/CVE-2026-81920.md) `CVE-2026-81920` · CVE record: Concrete CMS Concrete CMS · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action](https://agentprime.io/advisories/CVE-2026-68532.md) `CVE-2026-68532` · CVE record: Concrete CMS Concrete CMS · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission](https://agentprime.io/advisories/CVE-2026-68533.md) `CVE-2026-68533` · CVE record: Concrete CMS Concrete CMS · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors](https://agentprime.io/advisories/CVE-2026-68534.md) `CVE-2026-68534` · CVE record: Concrete CMS Concrete CMS · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint](https://agentprime.io/advisories/CVE-2026-81919.md) `CVE-2026-81919` · CVE record: Concrete CMS Concrete CMS · CVSS 2.3 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard](https://agentprime.io/advisories/CVE-2026-81899.md) `CVE-2026-81899` · CVE record: Concrete CMS Concrete CMS · CVSS 7.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.](https://agentprime.io/advisories/CVE-2026-18115.md) `CVE-2026-18115` · CVE record: Concrete CMS Concrete CMS · CVSS 7.4 High · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names](https://agentprime.io/advisories/CVE-2026-18113.md) `CVE-2026-18113` · CVE record: Concrete CMS Concrete CMS · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views](https://agentprime.io/advisories/CVE-2026-81898.md) `CVE-2026-81898` · CVE record: Concrete CMS Concrete CMS · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control](https://agentprime.io/advisories/CVE-2026-81897.md) `CVE-2026-81897` · CVE record: Concrete CMS Concrete CMS · CVSS 7.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF) - [Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label](https://agentprime.io/advisories/CVE-2026-81896.md) `CVE-2026-81896` · CVE record: Concrete CMS Concrete CMS · CVSS 8.4 High · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification](https://agentprime.io/advisories/CVE-2026-18111.md) `CVE-2026-18111` · CVE record: Concrete CMS Concrete CMS · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass - [Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via \`fsID\[\]\` in \`setMode=any\`](https://agentprime.io/advisories/CVE-2026-81895.md) `CVE-2026-81895` · CVE record: Concrete CMS Concrete CMS · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field](https://agentprime.io/advisories/CVE-2026-81894.md) `CVE-2026-81894` · CVE record: Concrete CMS Concrete CMS · CVSS 8.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection - [Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve th…](https://agentprime.io/advisories/CVE-2026-18110.md) `CVE-2026-18110` · CVE record: Concrete CMS Concrete CMS · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)](https://agentprime.io/advisories/CVE-2026-81900.md) `CVE-2026-81900` · CVE record: Concrete CMS Concrete CMS · CVSS 7.3 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications](https://agentprime.io/advisories/CVE-2026-18116.md) `CVE-2026-18116` · CVE record: Concrete CMS Concrete CMS · CVSS 7.3 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name](https://agentprime.io/advisories/CVE-2026-18117.md) `CVE-2026-18117` · CVE record: Concrete CMS Concrete CMS · CVSS 7.3 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the \`PUT /pages/{cID}\` endpoint](https://agentprime.io/advisories/CVE-2026-81901.md) `CVE-2026-81901` · CVE record: Concrete CMS Concrete CMS · CVSS 7.2 High · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup](https://agentprime.io/advisories/CVE-2026-81902.md) `CVE-2026-81902` · CVE record: Concrete CMS Concrete CMS · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon](https://agentprime.io/advisories/CVE-2026-81903.md) `CVE-2026-81903` · CVE record: Concrete CMS Concrete CMS · CVSS 7.0 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values](https://agentprime.io/advisories/CVE-2026-18119.md) `CVE-2026-18119` · CVE record: Concrete CMS Concrete CMS · CVSS 7.0 High · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records](https://agentprime.io/advisories/CVE-2026-81907.md) `CVE-2026-81907` · CVE record: Concrete CMS Concrete CMS · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block](https://agentprime.io/advisories/CVE-2026-81918.md) `CVE-2026-81918` · CVE record: Concrete CMS Concrete CMS · CVSS 4.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags](https://agentprime.io/advisories/CVE-2026-81917.md) `CVE-2026-81917` · CVE record: Concrete CMS Concrete CMS · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions](https://agentprime.io/advisories/CVE-2026-68535.md) `CVE-2026-68535` · CVE record: Concrete CMS Concrete CMS · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object](https://agentprime.io/advisories/CVE-2026-81916.md) `CVE-2026-81916` · CVE record: Concrete CMS Concrete CMS · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [In Concrete CMS below 9.5.3, Page Type update omits object-level authorization](https://agentprime.io/advisories/CVE-2026-81915.md) `CVE-2026-81915` · CVE record: Concrete CMS Concrete CMS · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller](https://agentprime.io/advisories/CVE-2026-68526.md) `CVE-2026-68526` · CVE record: Concrete CMS Concrete CMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.](https://agentprime.io/advisories/CVE-2026-81913.md) `CVE-2026-81913` · CVE record: Concrete CMS Concrete CMS · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Open redirect - [Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature](https://agentprime.io/advisories/CVE-2026-81912.md) `CVE-2026-81912` · CVE record: Concrete CMS Concrete CMS · CVSS 5.7 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site request forgery (CSRF) - [Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description](https://agentprime.io/advisories/CVE-2026-81911.md) `CVE-2026-81911` · CVE record: Concrete CMS Concrete CMS · CVSS 5.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values](https://agentprime.io/advisories/CVE-2026-81910.md) `CVE-2026-81910` · CVE record: Concrete CMS Concrete CMS · CVSS 5.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection - [Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks](https://agentprime.io/advisories/CVE-2026-81909.md) `CVE-2026-81909` · CVE record: Concrete CMS Concrete CMS · CVSS 5.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title](https://agentprime.io/advisories/CVE-2026-68528.md) `CVE-2026-68528` · CVE record: Concrete CMS Concrete CMS · CVSS 6.0 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS) - [Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization](https://agentprime.io/advisories/CVE-2026-18122.md) `CVE-2026-18122` · CVE record: Concrete CMS Concrete CMS · CVSS 6.0 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups](https://agentprime.io/advisories/CVE-2026-81908.md) `CVE-2026-81908` · CVE record: Concrete CMS Concrete CMS · CVSS 6.0 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control - [\[UNREVIEWED\] OAuth Callback Login Bypasses Deactivated-Account Checks](https://agentprime.io/advisories/CVE-2026-81906.md) `CVE-2026-81906` · CVE record: Concrete CMS Concrete CMS · CVSS 6.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Authentication bypass Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .