concrete5/concrete5 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-8237Mediumconcrete5/concrete5: Concrete CMS is vulnerable to IDOR CVE-2026-7879Mediumconcrete5/concrete5: Concrete CMS has an unauthorized file access issue CVE-2026-8327Mediumconcrete5/concrete5: Concrete CMS has a session-hardening bypass and allows password change without reauthorization CVE-2026-8236Mediumconcrete5/concrete5: Concrete CMS is vulnerable to IDOR combined with a missing authentication gate CVE-2026-7882Lowconcrete5/concrete5: Concrete CMS is vulnerable to unauthorized file deletion CVE-2026-7886Lowconcrete5/concrete5: Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage CVE-2026-8426Highconcrete5/concrete5: Concrete CMS does not validate a CSRF token before processing requests to…CVE-2026-8421Highconcrete5/concrete5: Concrete CMS contains a CSRF vulnerability CVE-2026-8428Highconcrete5/concrete5: Concrete CMS is Vulnerable to Cross-Site Request Forgery CVE-2026-8417Highconcrete5/concrete5: Concrete does not validate a CSRF token before processing requests to…CVE-2026-8205Mediumconcrete5/concrete5: Concrete CMS is vulnerable to authorization bypass in the Calendar Block CVE-2026-8203Highconcrete5/concrete5: Concrete CMS has Stored XSS through its height parameter CVE-2026-8350Highconcrete5/concrete5: Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php CVE-2026-8204Mediumconcrete5/concrete5: Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog CVE-2026-8135Highconcrete5/concrete5: Concrete CMS Vulnerable to Deserialization of Untrusted Data CVE-2026-8197Highconcrete5/concrete5: Concrete CMS is vulnerable to Stored XSS via OAuth integration name CVE-2026-6826Mediumconcrete5/concrete5: Concrete CMS is vulnerable to unauthenticated file usage disclosure CVE-2026-8140Highconcrete5/concrete5: Concrete CMS is Vulnerable to Cross-Site Request Forgery CVE-2026-8134Criticalconcrete5/concrete5: Concrete CMS Vulnerable to Relative Path Traversal CVE-2026-30662Mediumconcrete5/concrete5: ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads CVE-2026-3242Mediumconcrete5/concrete5: Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3241Mediumconcrete5/concrete5: Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3240Mediumconcrete5/concrete5: Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-2994Lowconcrete5/concrete5: Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)CVE-2026-3452Highconcrete5/concrete5: Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo