{"schema_version":1,"title":"Concrete CMS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 108 vulnerabilities in Concrete CMS: 0 in the last 7 days and 62 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-85387, was published on 16 September 2026.","url":"https://junglewise.ai/threats/technologies/concrete-cms","json_url":"https://junglewise.ai/threats/technologies/concrete-cms.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/concrete-cms","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":20,"all_time":108,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":62,"last_90_days":62,"last_365_days":108},"latest":[{"cve":"CVE-2026-85387","cvss":7.1,"epss":0.0025,"slug":"cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass","title":"Concrete CMS OAuth REST API authorization bypass","severity":"high","exploited":false,"published_at":"2026-09-16T18:17:17.85+00:00","url":"https://junglewise.ai/threats/cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass"},{"cve":"CVE-2026-18120","cvss":5.9,"epss":0.0027,"slug":"cve-2026-18120-concrete-cms-unauthenticated-express-entry-search-disclosure","title":"Concrete CMS unauthenticated Express entry search disclosure","severity":"medium","exploited":false,"published_at":"2026-09-16T18:17:07.97+00:00","url":"https://junglewise.ai/threats/cve-2026-18120-concrete-cms-unauthenticated-express-entry-search-disclosure"},{"cve":"CVE-2026-87031","cvss":2.7,"epss":0.0034,"slug":"cve-2026-87031-concrete-cms-rest-api-user-creation-permission-bypass","title":"Concrete CMS REST API user creation permission bypass","severity":"low","exploited":false,"published_at":"2026-09-16T17:18:16.703+00:00","url":"https://junglewise.ai/threats/cve-2026-87031-concrete-cms-rest-api-user-creation-permission-bypass"},{"cve":"CVE-2026-87028","cvss":6.5,"epss":0.0038,"slug":"cve-2026-87028-concrete-cms-access-control-bypass-in-board-custom-slot-preview","title":"Concrete CMS access control bypass in board custom-slot preview","severity":"medium","exploited":false,"published_at":"2026-09-16T17:18:16.56+00:00","url":"https://junglewise.ai/threats/cve-2026-87028-concrete-cms-access-control-bypass-in-board-custom-slot-preview"},{"cve":"CVE-2026-85386","cvss":6.1,"epss":0.0024,"slug":"cve-2026-85386-concrete-cms-stored-xss-via-xml-file-upload-in-form-block","title":"Concrete CMS stored XSS via XML file upload in Form Block","severity":"medium","exploited":false,"published_at":"2026-09-16T17:18:15.71+00:00","url":"https://junglewise.ai/threats/cve-2026-85386-concrete-cms-stored-xss-via-xml-file-upload-in-form-block"},{"cve":"CVE-2026-85385","cvss":9.6,"epss":0.005,"slug":"cve-2026-85385-concrete-cms-stored-xss-in-user-timezone-field","title":"Concrete CMS stored XSS in user timezone field","severity":"critical","exploited":false,"published_at":"2026-09-16T17:18:15.577+00:00","url":"https://junglewise.ai/threats/cve-2026-85385-concrete-cms-stored-xss-in-user-timezone-field"},{"cve":"CVE-2026-81927","cvss":5.4,"epss":0.0024,"slug":"cve-2026-81927-concrete-cms-stored-xss-in-svg-file-handling","title":"Concrete CMS stored XSS in SVG file handling","severity":"medium","exploited":false,"published_at":"2026-09-15T21:16:43.22+00:00","url":"https://junglewise.ai/threats/cve-2026-81927-concrete-cms-stored-xss-in-svg-file-handling"},{"cve":"CVE-2026-81926","cvss":6.1,"epss":0.0026,"slug":"cve-2026-81926-concrete-cms-stored-xss-in-page-path-duplicate-dialog","title":"Concrete CMS stored XSS in page path duplicate dialog","severity":"medium","exploited":false,"published_at":"2026-09-15T21:16:43.067+00:00","url":"https://junglewise.ai/threats/cve-2026-81926-concrete-cms-stored-xss-in-page-path-duplicate-dialog"},{"cve":"CVE-2026-18426","cvss":6.5,"epss":0.0021,"slug":"cve-2026-18426-concrete-cms-express-form-block-authorization-bypass","title":"Concrete CMS Express Form block authorization bypass","severity":"medium","exploited":false,"published_at":"2026-09-15T21:16:36.23+00:00","url":"https://junglewise.ai/threats/cve-2026-18426-concrete-cms-express-form-block-authorization-bypass"},{"cve":"CVE-2026-81925","cvss":6.1,"epss":0.0027,"slug":"cve-2026-81925-concrete-cms-reflected-xss-in-conversation-date-format","title":"Concrete CMS reflected XSS in conversation date format","severity":"medium","exploited":false,"published_at":"2026-09-15T20:18:04.09+00:00","url":"https://junglewise.ai/threats/cve-2026-81925-concrete-cms-reflected-xss-in-conversation-date-format"},{"cve":"CVE-2026-18425","cvss":2.7,"epss":0.0012,"slug":"cve-2026-18425-concrete-cms-dashboard-sitemap-reorder-authorization-bypass","title":"Concrete CMS dashboard sitemap reorder authorization bypass","severity":"low","exploited":false,"published_at":"2026-09-15T20:17:10.45+00:00","url":"https://junglewise.ai/threats/cve-2026-18425-concrete-cms-dashboard-sitemap-reorder-authorization-bypass"},{"cve":"CVE-2026-18424","cvss":7.1,"epss":0.0024,"slug":"cve-2026-18424-concrete-cms-server-side-request-forgery-in-remote-file-import","title":"Concrete CMS Server-Side Request Forgery in remote file import","severity":"high","exploited":false,"published_at":"2026-09-15T20:17:10.31+00:00","url":"https://junglewise.ai/threats/cve-2026-18424-concrete-cms-server-side-request-forgery-in-remote-file-import"},{"cve":"CVE-2026-18423","cvss":7.1,"epss":0.0025,"slug":"cve-2026-18423-concrete-cms-insecure-direct-object-reference-in-express-saved","title":"Concrete CMS insecure direct object reference in Express saved search presets","severity":"high","exploited":false,"published_at":"2026-09-15T20:17:09.8+00:00","url":"https://junglewise.ai/threats/cve-2026-18423-concrete-cms-insecure-direct-object-reference-in-express-saved"},{"cve":"CVE-2026-18422","cvss":6.5,"epss":0.0044,"slug":"cve-2026-18422-concrete-cms-authorization-and-csrf-bypass-in-multilingual-page","title":"Concrete CMS authorization and CSRF bypass in multilingual page assignment","severity":"medium","exploited":false,"published_at":"2026-09-15T20:17:09.29+00:00","url":"https://junglewise.ai/threats/cve-2026-18422-concrete-cms-authorization-and-csrf-bypass-in-multilingual-page"},{"cve":"CVE-2026-81924","cvss":6.5,"epss":0.0021,"slug":"cve-2026-81924-concrete-cms-csrf-in-theme-page-template-activation","title":"Concrete CMS CSRF in theme page-template activation","severity":"medium","exploited":false,"published_at":"2026-09-15T19:17:41.85+00:00","url":"https://junglewise.ai/threats/cve-2026-81924-concrete-cms-csrf-in-theme-page-template-activation"},{"cve":"CVE-2026-81923","cvss":2.7,"epss":0.003,"slug":"cve-2026-81923-concrete-cms-seo-bulk-update-privilege-escalation","title":"Concrete CMS SEO Bulk Update privilege escalation","severity":"low","exploited":false,"published_at":"2026-09-15T19:17:41.733+00:00","url":"https://junglewise.ai/threats/cve-2026-81923-concrete-cms-seo-bulk-update-privilege-escalation"},{"cve":"CVE-2026-81922","cvss":2.7,"epss":0.003,"slug":"cve-2026-81922-concrete-cms-authorization-bypass-in-sitemap-page-reordering","title":"Concrete CMS authorization bypass in sitemap page reordering","severity":"low","exploited":false,"published_at":"2026-09-15T19:17:41.61+00:00","url":"https://junglewise.ai/threats/cve-2026-81922-concrete-cms-authorization-bypass-in-sitemap-page-reordering"},{"cve":"CVE-2026-81921","cvss":5.4,"epss":0.0024,"slug":"cve-2026-81921-concrete-cms-oauth-2-0-refresh-token-account-status-bypass","title":"Concrete CMS OAuth 2.0 refresh token account status bypass","severity":"medium","exploited":false,"published_at":"2026-09-15T19:17:41.483+00:00","url":"https://junglewise.ai/threats/cve-2026-81921-concrete-cms-oauth-2-0-refresh-token-account-status-bypass"},{"cve":"CVE-2026-81920","cvss":4.3,"epss":0.0018,"slug":"cve-2026-81920-concrete-cms-csrf-in-dashboard-seo-excluded-words-page","title":"Concrete CMS CSRF in dashboard SEO Excluded Words page","severity":"medium","exploited":false,"published_at":"2026-09-15T19:17:41.35+00:00","url":"https://junglewise.ai/threats/cve-2026-81920-concrete-cms-csrf-in-dashboard-seo-excluded-words-page"},{"cve":"CVE-2026-81919","cvss":4.3,"epss":0.0015,"slug":"cve-2026-81919-concrete-cms-csrf-in-block-arrangement-endpoint","title":"Concrete CMS CSRF in block arrangement endpoint","severity":"medium","exploited":false,"published_at":"2026-09-15T19:17:41.2+00:00","url":"https://junglewise.ai/threats/cve-2026-81919-concrete-cms-csrf-in-block-arrangement-endpoint"},{"cve":"CVE-2026-68534","cvss":2.3,"epss":0.0057,"slug":"cve-2026-68534-concrete-cms-stored-cross-site-scripting-in-express-entry-labels","title":"Concrete CMS stored cross-site scripting in Express entry labels","severity":"info","exploited":false,"published_at":"2026-09-15T19:17:37.303+00:00","url":"https://junglewise.ai/threats/cve-2026-68534-concrete-cms-stored-cross-site-scripting-in-express-entry-labels"},{"cve":"CVE-2026-68533","cvss":2.3,"epss":0.0039,"slug":"cve-2026-68533-concrete-cms-authorization-bypass-in-file-upload-endpoint","title":"Concrete CMS authorization bypass in file upload endpoint","severity":"info","exploited":false,"published_at":"2026-09-15T19:17:37.17+00:00","url":"https://junglewise.ai/threats/cve-2026-68533-concrete-cms-authorization-bypass-in-file-upload-endpoint"},{"cve":"CVE-2026-68532","cvss":2.3,"epss":0.003,"slug":"cve-2026-68532-concrete-cms-dashboard-group-type-csrf-in-delete-action","title":"Concrete CMS dashboard group type CSRF in delete action","severity":"info","exploited":false,"published_at":"2026-09-15T19:17:37.033+00:00","url":"https://junglewise.ai/threats/cve-2026-68532-concrete-cms-dashboard-group-type-csrf-in-delete-action"},{"cve":"CVE-2026-68531","cvss":2.1,"epss":0.0047,"slug":"cve-2026-68531-concrete-cms-sql-wildcard-injection-in-search-filters","title":"Concrete CMS SQL wildcard injection in search filters","severity":"info","exploited":false,"published_at":"2026-09-15T19:17:36.903+00:00","url":"https://junglewise.ai/threats/cve-2026-68531-concrete-cms-sql-wildcard-injection-in-search-filters"},{"cve":"CVE-2026-68530","cvss":2.1,"epss":0.0047,"slug":"cve-2026-68530-concrete-cms-authorization-bypass-in-board-instance-actions","title":"Concrete CMS authorization bypass in board instance actions","severity":"info","exploited":false,"published_at":"2026-09-15T19:17:36.77+00:00","url":"https://junglewise.ai/threats/cve-2026-68530-concrete-cms-authorization-bypass-in-board-instance-actions"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":18},{"week":"2026-09-14","critical":2,"exploited":0,"vulnerabilities":44},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Concrete CMS","slug":"concrete-cms","vendor":{"name":"Concrete CMS","slug":"concrete-cms","url":"https://junglewise.ai/threats/vendors/concrete-cms"},"aliases":[],"category":"cms","homepage":"https://www.concretecms.com/","repo_url":"https://github.com/concretecms/concretecms","description":"Concrete CMS is an open-source content management system designed for ease of use by both developers and content editors.","url":"https://junglewise.ai/threats/technologies/concrete-cms"},"most_severe":[{"cve":"CVE-2026-85385","cvss":9.6,"epss":0.005,"slug":"cve-2026-85385-concrete-cms-stored-xss-in-user-timezone-field","title":"Concrete CMS stored XSS in user timezone field","severity":"critical","exploited":false,"published_at":"2026-09-16T17:18:15.577+00:00","url":"https://junglewise.ai/threats/cve-2026-85385-concrete-cms-stored-xss-in-user-timezone-field"},{"cve":"CVE-2026-18119","cvss":9,"epss":0.0031,"slug":"cve-2026-18119-concrete-cms-stored-cross-site-scripting-in-block-design-dialog","title":"Concrete CMS stored cross-site scripting in Block Design dialog","severity":"critical","exploited":false,"published_at":"2026-09-14T20:16:42.563+00:00","url":"https://junglewise.ai/threats/cve-2026-18119-concrete-cms-stored-cross-site-scripting-in-block-design-dialog"},{"cve":"CVE-2026-81901","cvss":8.7,"epss":0.0038,"slug":"cve-2026-81901-concrete-cms-rest-api-authorization-bypass-in-page-update","title":"Concrete CMS REST API authorization bypass in page update endpoint","severity":"high","exploited":false,"published_at":"2026-09-14T21:17:26.123+00:00","url":"https://junglewise.ai/threats/cve-2026-81901-concrete-cms-rest-api-authorization-bypass-in-page-update"},{"cve":"CVE-2026-81902","cvss":8.1,"epss":0.0024,"slug":"cve-2026-81902-concrete-cms-csrf-token-validation-bypass-in-block-removal","title":"Concrete CMS CSRF token validation bypass in block removal","severity":"high","exploited":false,"published_at":"2026-09-14T21:17:26.267+00:00","url":"https://junglewise.ai/threats/cve-2026-81902-concrete-cms-csrf-token-validation-bypass-in-block-removal"},{"cve":"CVE-2026-18110","cvss":7.5,"epss":0.0027,"slug":"cve-2026-18110-concrete-cms-user-selector-autocomplete-authorization-bypass","title":"Concrete CMS user selector autocomplete authorization bypass","severity":"high","exploited":false,"published_at":"2026-09-15T17:17:11.11+00:00","url":"https://junglewise.ai/threats/cve-2026-18110-concrete-cms-user-selector-autocomplete-authorization-bypass"},{"cve":"CVE-2026-8134","cvss":7.2,"epss":0.0111,"slug":"cve-2026-8134-concrete-cms-path-traversal-and-rce-in-composer-form-layouts","title":"Concrete CMS path traversal and RCE in composer form layouts","severity":"high","exploited":false,"published_at":"2026-05-21T21:16:32.837+00:00","url":"https://junglewise.ai/threats/cve-2026-8134-concrete-cms-path-traversal-and-rce-in-composer-form-layouts"},{"cve":"CVE-2026-81895","cvss":7.2,"epss":0.0051,"slug":"cve-2026-81895-concrete-cms-document-library-block-sql-injection","title":"Concrete CMS Document Library block SQL injection","severity":"high","exploited":false,"published_at":"2026-09-15T17:17:27.71+00:00","url":"https://junglewise.ai/threats/cve-2026-81895-concrete-cms-document-library-block-sql-injection"},{"cve":"CVE-2026-85387","cvss":7.1,"epss":0.0025,"slug":"cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass","title":"Concrete CMS OAuth REST API authorization bypass","severity":"high","exploited":false,"published_at":"2026-09-16T18:17:17.85+00:00","url":"https://junglewise.ai/threats/cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass"},{"cve":"CVE-2026-18423","cvss":7.1,"epss":0.0025,"slug":"cve-2026-18423-concrete-cms-insecure-direct-object-reference-in-express-saved","title":"Concrete CMS insecure direct object reference in Express saved search presets","severity":"high","exploited":false,"published_at":"2026-09-15T20:17:09.8+00:00","url":"https://junglewise.ai/threats/cve-2026-18423-concrete-cms-insecure-direct-object-reference-in-express-saved"},{"cve":"CVE-2026-18424","cvss":7.1,"epss":0.0024,"slug":"cve-2026-18424-concrete-cms-server-side-request-forgery-in-remote-file-import","title":"Concrete CMS Server-Side Request Forgery in remote file import","severity":"high","exploited":false,"published_at":"2026-09-15T20:17:10.31+00:00","url":"https://junglewise.ai/threats/cve-2026-18424-concrete-cms-server-side-request-forgery-in-remote-file-import"}],"generated_at":"2026-09-26T19:07:00.176898+00:00"}