| n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of… CVE-2026-87031 | Severity low |
| Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board… CVE-2026-87028 | Severity medium |
| Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account… CVE-2026-85387 | Severity high |
| Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML… CVE-2026-85386 | Severity medium |
| Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the… CVE-2026-85385 | Severity critical |
| Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the… CVE-2026-81927 | Severity medium |
| Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path… CVE-2026-81926 | Severity medium |
| Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in… CVE-2026-81925 | Severity medium |
| Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard… CVE-2026-81924 | Severity medium |
| In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord()… CVE-2026-81923 | Severity low |
| Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore… CVE-2026-81922 | Severity low |
| Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new… CVE-2026-81921 | Severity medium |
| Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller… CVE-2026-81920 | Severity medium |
| Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of… CVE-2026-81919 | Severity medium |
| Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with… CVE-2026-81918 | Severity medium |
| Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library… CVE-2026-81917 | Severity medium |
| Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather… CVE-2026-81916 | Severity medium |
| Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard… CVE-2026-81915 | Severity medium |
| Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on… CVE-2026-81913 | Severity medium |
| Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The… CVE-2026-81912 | Severity medium |
| Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint… CVE-2026-81911 | Severity medium |
| Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values… CVE-2026-81910 | Severity medium |
| Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST… CVE-2026-81907 | Severity high |
| Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the… CVE-2026-81903 | Severity medium |
| Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote… CVE-2026-81902 | Severity high |
| In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property… CVE-2026-81901 | Severity high |
| Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML… CVE-2026-81900 | Severity medium |
| In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF… CVE-2026-81897 | Severity medium |
| Concrete CMS before 9.5.3 does not apply HTML entity encoding to user-defined Form block question labels when rendering them as column… CVE-2026-81896 | Severity medium |
| In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them… CVE-2026-81895 | Severity high |
| Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field… CVE-2026-81894 | Severity medium |
| Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on… CVE-2026-68535 | Severity medium |
| Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller… CVE-2026-68526 | Severity medium |
| Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management… CVE-2026-18426 | Severity medium |
| Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using… CVE-2026-18425 | Severity low |
| Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS… CVE-2026-18424 | Severity high |
| Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and… CVE-2026-18423 | Severity high |
| Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page… CVE-2026-18422 | Severity medium |
| Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the… CVE-2026-18120 | Severity medium |
| Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink… CVE-2026-18119 | Severity critical |
| Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog… CVE-2026-18117 | Severity medium |
| Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow… CVE-2026-18116 | Severity medium |
| Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint… CVE-2026-18110 | Severity high |
Zetlyn