Low
CVE-2026-8139
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 121
Reset filters
Low
CVE-2026-7890
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation
Low
CVE-2026-7887
Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status
Medium
CVE-2026-7881
Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block
Medium
CVE-2026-8236
Concrete CMS is vulnerable to IDOR combined with a missing authentication gate
Medium
CVE-2026-8239
Concrete CMS is vulnerable to IDOR
Medium
CVE-2026-8327
Concrete CMS has a session-hardening bypass and allows password change without reauthorization
Low
CVE-2026-7882
Concrete CMS is vulnerable to unauthorized file deletion
Medium
CVE-2026-7879
Concrete CMS has an unauthorized file access issue
High
CVE-2026-8417
Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>`
High
CVE-2026-8426
Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`
High
CVE-2026-8421
Concrete CMS contains a CSRF vulnerability
Medium
CVE-2026-8205
Concrete CMS is vulnerable to authorization bypass in the Calendar Block
Medium
CVE-2026-8204
Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog
High
CVE-2026-8428
Concrete CMS is Vulnerable to Cross-Site Request Forgery
High
CVE-2026-8350
Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php
High
CVE-2026-8203
Concrete CMS has Stored XSS through its height parameter
Medium
CVE-2026-6826
Concrete CMS is vulnerable to unauthenticated file usage disclosure
High
CVE-2026-8140
Concrete CMS is Vulnerable to Cross-Site Request Forgery
High
CVE-2026-8135
Concrete CMS Vulnerable to Deserialization of Untrusted Data
High
CVE-2026-8197
Concrete CMS is vulnerable to Stored XSS via OAuth integration name
Critical
CVE-2026-8134
Concrete CMS Vulnerable to Relative Path Traversal
Medium
CVE-2026-30662
ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads
Medium
CVE-2026-3242
Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.