High
CVE-2026-10721
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 121
Reset filters
High
CVE-2026-7888
Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
Low
CVE-2026-8347
Concrete CMS is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog
Low
CVE-2026-8340
Concrete CMS is vulnerable to CSRF via Backend\File::approveVersion
Low
CVE-2026-8353
Concrete CMS is vulnerable to Stored XSS via page name in the Atomik theme
Low
CVE-2026-8416
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id)
Low
CVE-2026-8413
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
Medium
CVE-2026-8245
Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination
Low
CVE-2026-8432
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star()
Medium
CVE-2026-8337
Concrete CMS is vulnerable to IDOR in surveys
Low
CVE-2026-8409
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
Low
CVE-2026-8435
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()
Low
CVE-2026-8412
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
Low
CVE-2026-8410
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
Low
CVE-2026-8415
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder
Low
CVE-2026-8414
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
Low
CVE-2026-8411
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
Low
CVE-2026-8433
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()
Low
CVE-2026-8434
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()
Low
CVE-2026-8427
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)
Medium
CVE-2026-8237
Concrete CMS is vulnerable to IDOR
Medium
CVE-2026-8240
Concrete CMS is vulnerable to unauthenticated page metadata disclosure
Medium
CVE-2026-8238
Concrete CMS is vulnerable to IDOR
Low
CVE-2026-7886
Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.