# Concrete CMS vulnerabilities Source: https://junglewise.ai/threats/technologies/concrete-cms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/concrete-cms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 108 vulnerabilities in Concrete CMS: 0 in the last 7 days and 62 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-85387, was published on 16 September 2026. Nothing in the last four weeks, down from 44 vulnerabilities in the four before. 0 critical against 2. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 62 - All time: 108 (2 critical, 0 exploited in the wild) ## About Concrete CMS Concrete CMS is an open-source content management system designed for ease of use by both developers and content editors. ## Latest Concrete CMS vulnerabilities - [CVE-2026-85387: Concrete CMS OAuth REST API authorization bypass](https://junglewise.ai/threats/cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass) (high, CVSS 7.1, published 16 Sep 2026) - [CVE-2026-18120: Concrete CMS unauthenticated Express entry search disclosure](https://junglewise.ai/threats/cve-2026-18120-concrete-cms-unauthenticated-express-entry-search-disclosure) (medium, CVSS 5.9, published 16 Sep 2026) - [CVE-2026-87031: Concrete CMS REST API user creation permission bypass](https://junglewise.ai/threats/cve-2026-87031-concrete-cms-rest-api-user-creation-permission-bypass) (low, CVSS 2.7, published 16 Sep 2026) - [CVE-2026-87028: Concrete CMS access control bypass in board custom-slot preview](https://junglewise.ai/threats/cve-2026-87028-concrete-cms-access-control-bypass-in-board-custom-slot-preview) (medium, CVSS 6.5, published 16 Sep 2026) - [CVE-2026-85386: Concrete CMS stored XSS via XML file upload in Form Block](https://junglewise.ai/threats/cve-2026-85386-concrete-cms-stored-xss-via-xml-file-upload-in-form-block) (medium, CVSS 6.1, published 16 Sep 2026) - [CVE-2026-85385: Concrete CMS stored XSS in user timezone field](https://junglewise.ai/threats/cve-2026-85385-concrete-cms-stored-xss-in-user-timezone-field) (critical, CVSS 9.6, published 16 Sep 2026) - [CVE-2026-81927: Concrete CMS stored XSS in SVG file handling](https://junglewise.ai/threats/cve-2026-81927-concrete-cms-stored-xss-in-svg-file-handling) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2026-81926: Concrete CMS stored XSS in page path duplicate dialog](https://junglewise.ai/threats/cve-2026-81926-concrete-cms-stored-xss-in-page-path-duplicate-dialog) (medium, CVSS 6.1, published 15 Sep 2026) - [CVE-2026-18426: Concrete CMS Express Form block authorization bypass](https://junglewise.ai/threats/cve-2026-18426-concrete-cms-express-form-block-authorization-bypass) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-81925: Concrete CMS reflected XSS in conversation date format](https://junglewise.ai/threats/cve-2026-81925-concrete-cms-reflected-xss-in-conversation-date-format) (medium, CVSS 6.1, published 15 Sep 2026) - [CVE-2026-18425: Concrete CMS dashboard sitemap reorder authorization bypass](https://junglewise.ai/threats/cve-2026-18425-concrete-cms-dashboard-sitemap-reorder-authorization-bypass) (low, CVSS 2.7, published 15 Sep 2026) - [CVE-2026-18424: Concrete CMS Server-Side Request Forgery in remote file import](https://junglewise.ai/threats/cve-2026-18424-concrete-cms-server-side-request-forgery-in-remote-file-import) (high, CVSS 7.1, published 15 Sep 2026) - [CVE-2026-18423: Concrete CMS insecure direct object reference in Express saved search presets](https://junglewise.ai/threats/cve-2026-18423-concrete-cms-insecure-direct-object-reference-in-express-saved) (high, CVSS 7.1, published 15 Sep 2026) - [CVE-2026-18422: Concrete CMS authorization and CSRF bypass in multilingual page assignment](https://junglewise.ai/threats/cve-2026-18422-concrete-cms-authorization-and-csrf-bypass-in-multilingual-page) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-81924: Concrete CMS CSRF in theme page-template activation](https://junglewise.ai/threats/cve-2026-81924-concrete-cms-csrf-in-theme-page-template-activation) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-81923: Concrete CMS SEO Bulk Update privilege escalation](https://junglewise.ai/threats/cve-2026-81923-concrete-cms-seo-bulk-update-privilege-escalation) (low, CVSS 2.7, published 15 Sep 2026) - [CVE-2026-81922: Concrete CMS authorization bypass in sitemap page reordering](https://junglewise.ai/threats/cve-2026-81922-concrete-cms-authorization-bypass-in-sitemap-page-reordering) (low, CVSS 2.7, published 15 Sep 2026) - [CVE-2026-81921: Concrete CMS OAuth 2.0 refresh token account status bypass](https://junglewise.ai/threats/cve-2026-81921-concrete-cms-oauth-2-0-refresh-token-account-status-bypass) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2026-81920: Concrete CMS CSRF in dashboard SEO Excluded Words page](https://junglewise.ai/threats/cve-2026-81920-concrete-cms-csrf-in-dashboard-seo-excluded-words-page) (medium, CVSS 4.3, published 15 Sep 2026) - [CVE-2026-81919: Concrete CMS CSRF in block arrangement endpoint](https://junglewise.ai/threats/cve-2026-81919-concrete-cms-csrf-in-block-arrangement-endpoint) (medium, CVSS 4.3, published 15 Sep 2026) - [CVE-2026-68534: Concrete CMS stored cross-site scripting in Express entry labels](https://junglewise.ai/threats/cve-2026-68534-concrete-cms-stored-cross-site-scripting-in-express-entry-labels) (info, CVSS 2.3, published 15 Sep 2026) - [CVE-2026-68533: Concrete CMS authorization bypass in file upload endpoint](https://junglewise.ai/threats/cve-2026-68533-concrete-cms-authorization-bypass-in-file-upload-endpoint) (info, CVSS 2.3, published 15 Sep 2026) - [CVE-2026-68532: Concrete CMS dashboard group type CSRF in delete action](https://junglewise.ai/threats/cve-2026-68532-concrete-cms-dashboard-group-type-csrf-in-delete-action) (info, CVSS 2.3, published 15 Sep 2026) - [CVE-2026-68531: Concrete CMS SQL wildcard injection in search filters](https://junglewise.ai/threats/cve-2026-68531-concrete-cms-sql-wildcard-injection-in-search-filters) (info, CVSS 2.1, published 15 Sep 2026) - [CVE-2026-68530: Concrete CMS authorization bypass in board instance actions](https://junglewise.ai/threats/cve-2026-68530-concrete-cms-authorization-bypass-in-board-instance-actions) (info, CVSS 2.1, published 15 Sep 2026) ## Most severe Concrete CMS vulnerabilities - [CVE-2026-85385: Concrete CMS stored XSS in user timezone field](https://junglewise.ai/threats/cve-2026-85385-concrete-cms-stored-xss-in-user-timezone-field) (critical, CVSS 9.6, published 16 Sep 2026) - [CVE-2026-18119: Concrete CMS stored cross-site scripting in Block Design dialog](https://junglewise.ai/threats/cve-2026-18119-concrete-cms-stored-cross-site-scripting-in-block-design-dialog) (critical, CVSS 9, published 14 Sep 2026) - [CVE-2026-81901: Concrete CMS REST API authorization bypass in page update endpoint](https://junglewise.ai/threats/cve-2026-81901-concrete-cms-rest-api-authorization-bypass-in-page-update) (high, CVSS 8.7, published 14 Sep 2026) - [CVE-2026-81902: Concrete CMS CSRF token validation bypass in block removal](https://junglewise.ai/threats/cve-2026-81902-concrete-cms-csrf-token-validation-bypass-in-block-removal) (high, CVSS 8.1, published 14 Sep 2026) - [CVE-2026-18110: Concrete CMS user selector autocomplete authorization bypass](https://junglewise.ai/threats/cve-2026-18110-concrete-cms-user-selector-autocomplete-authorization-bypass) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2026-8134: Concrete CMS path traversal and RCE in composer form layouts](https://junglewise.ai/threats/cve-2026-8134-concrete-cms-path-traversal-and-rce-in-composer-form-layouts) (high, CVSS 7.2, published 21 May 2026) - [CVE-2026-81895: Concrete CMS Document Library block SQL injection](https://junglewise.ai/threats/cve-2026-81895-concrete-cms-document-library-block-sql-injection) (high, CVSS 7.2, published 15 Sep 2026) - [CVE-2026-85387: Concrete CMS OAuth REST API authorization bypass](https://junglewise.ai/threats/cve-2026-85387-concrete-cms-oauth-rest-api-authorization-bypass) (high, CVSS 7.1, published 16 Sep 2026) - [CVE-2026-18423: Concrete CMS insecure direct object reference in Express saved search presets](https://junglewise.ai/threats/cve-2026-18423-concrete-cms-insecure-direct-object-reference-in-express-saved) (high, CVSS 7.1, published 15 Sep 2026) - [CVE-2026-18424: Concrete CMS Server-Side Request Forgery in remote file import](https://junglewise.ai/threats/cve-2026-18424-concrete-cms-server-side-request-forgery-in-remote-file-import) (high, CVSS 7.1, published 15 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 44 vulnerabilities in the four before. 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 18 | 0 | 0 | | 14 Sep 2026 | 44 | 2 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Concrete CMS vulnerabilities", https://junglewise.ai/threats/technologies/concrete-cms, 9 November 2026.