# concrete5/concrete5 (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/concrete5-concrete5 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/concrete5-concrete5.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 122 vulnerabilities in concrete5/concrete5 (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-10721, was published on 10 June 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 122 (0 critical, 0 exploited in the wild) ## About concrete5/concrete5 (Packagist) Concrete CMS (formerly concrete5) is an open-source content management system written in PHP. ## Latest concrete5/concrete5 (Packagist) vulnerabilities - [CVE-2026-10721: Concrete CMS PHP object injection in Permission Cache and Search components](https://junglewise.ai/threats/cve-2026-10721-concrete-cms-php-object-injection-in-permission-cache-and-search) (high, CVSS 4, published 10 Jun 2026) - [CVE-2026-7888: Concrete CMS PHP object injection in Workflow and Form components](https://junglewise.ai/threats/cve-2026-7888-concrete-cms-php-object-injection-in-workflow-and-form-components) (high, CVSS 4, published 3 Jun 2026) - [CVE-2026-8353: Concrete CMS Stored XSS via page name in Atomik theme](https://junglewise.ai/threats/cve-2026-8353-concrete-cms-stored-xss-via-page-name-in-atomik-theme) (medium, CVSS 4.8, published 22 May 2026) - [CVE-2026-8347: Concrete CMS IDOR in Express association Reorder dialog](https://junglewise.ai/threats/cve-2026-8347-concrete-cms-idor-in-express-association-reorder-dialog) (medium, CVSS 4.3, published 22 May 2026) - [CVE-2026-8340: Concrete CMS CSRF in Backend File Version Approval](https://junglewise.ai/threats/cve-2026-8340-concrete-cms-csrf-in-backend-file-version-approval) (medium, CVSS 4.3, published 22 May 2026) - [CVE-2026-8435: Concrete CMS CSRF in file version approval](https://junglewise.ai/threats/cve-2026-8435-concrete-cms-csrf-in-file-version-approval) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8434: Concrete CMS CSRF in file rescanMultiple controller](https://junglewise.ai/threats/cve-2026-8434-concrete-cms-csrf-in-file-rescanmultiple-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8433: Concrete CMS CSRF in file rescan controller](https://junglewise.ai/threats/cve-2026-8433-concrete-cms-csrf-in-file-rescan-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8432: Concrete CMS CSRF in file star controller](https://junglewise.ai/threats/cve-2026-8432-concrete-cms-csrf-in-file-star-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8427: Concrete CMS CSRF in removeFavoriteFolder backend controller](https://junglewise.ai/threats/cve-2026-8427-concrete-cms-csrf-in-removefavoritefolder-backend-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8416: Concrete CMS CSRF in addFavoriteFolder backend controller](https://junglewise.ai/threats/cve-2026-8416-concrete-cms-csrf-in-addfavoritefolder-backend-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8415: Concrete CMS CSRF in Express association reordering](https://junglewise.ai/threats/cve-2026-8415-concrete-cms-csrf-in-express-association-reordering) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8414: Concrete CMS CSRF in event duplication controller](https://junglewise.ai/threats/cve-2026-8414-concrete-cms-csrf-in-event-duplication-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8413: Concrete CMS CSRF in bulk page design controller](https://junglewise.ai/threats/cve-2026-8413-concrete-cms-csrf-in-bulk-page-design-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8412: Concrete CMS CSRF in bulk page cache controller](https://junglewise.ai/threats/cve-2026-8412-concrete-cms-csrf-in-bulk-page-cache-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8411: Concrete CMS CSRF in bulk page deletion controller](https://junglewise.ai/threats/cve-2026-8411-concrete-cms-csrf-in-bulk-page-deletion-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8410: Concrete CMS CSRF in bulk log deletion](https://junglewise.ai/threats/cve-2026-8410-concrete-cms-csrf-in-bulk-log-deletion) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8409: Concrete CMS CSRF in log deletion controller](https://junglewise.ai/threats/cve-2026-8409-concrete-cms-csrf-in-log-deletion-controller) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8337: Concrete CMS IDOR in surveys](https://junglewise.ai/threats/cve-2026-8337-concrete-cms-idor-in-surveys) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8327: Concrete CMS unverified password change and session bypass](https://junglewise.ai/threats/cve-2026-8327-concrete-cms-unverified-password-change-and-session-bypass) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8245: Concrete CMS Reflected XSS in Legacy Pagination](https://junglewise.ai/threats/cve-2026-8245-concrete-cms-reflected-xss-in-legacy-pagination) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8240: Concrete CMS unauthenticated page metadata disclosure in summary templates](https://junglewise.ai/threats/cve-2026-8240-concrete-cms-unauthenticated-page-metadata-disclosure-in-summary) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8239: Concrete CMS IDOR in conversation rating endpoint](https://junglewise.ai/threats/cve-2026-8239-concrete-cms-idor-in-conversation-rating-endpoint) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8238: Concrete CMS IDOR in conversation message endpoint](https://junglewise.ai/threats/cve-2026-8238-concrete-cms-idor-in-conversation-message-endpoint) (medium, CVSS 4, published 21 May 2026) - [CVE-2026-8237: Concrete CMS IDOR in conversation message detail endpoint](https://junglewise.ai/threats/cve-2026-8237-concrete-cms-idor-in-conversation-message-detail-endpoint) (medium, CVSS 4, published 21 May 2026) ## Most severe concrete5/concrete5 (Packagist) vulnerabilities - [CVE-2026-8134: Concrete CMS path traversal and RCE in composer form layouts](https://junglewise.ai/threats/cve-2026-8134-concrete-cms-path-traversal-and-rce-in-composer-form-layouts) (high, CVSS 7.2, published 21 May 2026) - [CVE-2026-8135: Concrete CMS insecure deserialization in ExpressEntryList block](https://junglewise.ai/threats/cve-2026-8135-concrete-cms-insecure-deserialization-in-expressentrylist-block) (high, CVSS 4, published 21 May 2026) - [CVE-2026-8350: Concrete CMS privilege escalation in bulk user assignment](https://junglewise.ai/threats/cve-2026-8350-concrete-cms-privilege-escalation-in-bulk-user-assignment) (high, CVSS 4, published 21 May 2026) - [CVE-2026-7888: Concrete CMS PHP object injection in Workflow and Form components](https://junglewise.ai/threats/cve-2026-7888-concrete-cms-php-object-injection-in-workflow-and-form-components) (high, CVSS 4, published 3 Jun 2026) - [CVE-2026-8426: Concrete CMS CSRF to Remote Code Execution in package upgrades](https://junglewise.ai/threats/cve-2026-8426-concrete-cms-csrf-to-remote-code-execution-in-package-upgrades) (high, CVSS 4, published 21 May 2026) - [CVE-2026-8421: Concrete CMS CSRF in install_package method leads to RCE](https://junglewise.ai/threats/cve-2026-8421-concrete-cms-csrf-in-install-package-method-leads-to-rce) (high, CVSS 4, published 21 May 2026) - [CVE-2026-8197: Concrete CMS Stored XSS in OAuth integration name](https://junglewise.ai/threats/cve-2026-8197-concrete-cms-stored-xss-in-oauth-integration-name) (high, CVSS 4, published 21 May 2026) - [CVE-2026-8203: Concrete CMS Stored XSS in height parameter](https://junglewise.ai/threats/cve-2026-8203-concrete-cms-stored-xss-in-height-parameter) (high, CVSS 4, published 21 May 2026) - [CVE-2026-8428: Concrete CMS CSRF in dashboard update controller](https://junglewise.ai/threats/cve-2026-8428-concrete-cms-csrf-in-dashboard-update-controller) (high, CVSS 4, published 21 May 2026) - [CVE-2026-8417: Concrete CMS CSRF in package update dashboard](https://junglewise.ai/threats/cve-2026-8417-concrete-cms-csrf-in-package-update-dashboard) (high, CVSS 4, published 21 May 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq): 119 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "concrete5/concrete5 (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/concrete5-concrete5, 9 November 2026.