Security advisories

low2026-05-22

CVE-2026-8411-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete

concretecms/concretecms · GHSA-752x-23hp-jmv6

low2026-05-22

CVE-2026-8434-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple()

concretecms/concretecms · GHSA-6qjh-p324-694f

low2026-05-22

CVE-2026-8433-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan()

concretecms/concretecms · GHSA-6fxm-r8p3-mx5c

low2026-05-22

CVE-2026-8427-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id)

concretecms/concretecms · GHSA-67hj-8239-cmf5

low2026-05-22

CVE-2026-8409-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete

concretecms/concretecms · GHSA-56c9-xq5g-xrf9

low2026-05-22

CVE-2026-8435-Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion()

concretecms/concretecms · GHSA-44q4-354f-c826

medium2026-05-22

CVE-2026-8237-Concrete CMS is vulnerable to IDOR

concretecms/concretecms · GHSA-xpgc-7vc2-8725

medium2026-05-22

CVE-2026-8327-Concrete CMS has a session-hardening bypass and allows password change without reauthorization

concretecms/concretecms · GHSA-wmw3-3fv3-h54w

medium2026-05-22

CVE-2026-8240-Concrete CMS is vulnerable to unauthenticated page metadata disclosure

concretecms/concretecms · GHSA-vpgr-cwfx-pwfw

medium2026-05-22

CVE-2026-8238-Concrete CMS is vulnerable to IDOR

concretecms/concretecms · GHSA-qv3x-mffx-9gw8

low2026-05-22

CVE-2026-8139-Concrete CMS is vulnerable to Stored XSS via external-link page cvName

concretecms/concretecms · GHSA-pcrh-gj77-j4mw

low2026-05-22

CVE-2026-7886-Concrete CMS is vulnerable to IDOR in AddMessage/UpdateMessage

concretecms/concretecms · GHSA-p8p9-5953-h9jw

low2026-05-22

CVE-2026-7890-Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation

concretecms/concretecms · GHSA-gjwq-9v8p-47w7

medium2026-05-22

CVE-2026-7879-Concrete CMS has an unauthorized file access issue

concretecms/concretecms · GHSA-fqg3-8w8r-8g94

low2026-05-22

CVE-2026-7887-Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status

concretecms/concretecms · GHSA-f54h-78c9-c24h

medium2026-05-22

CVE-2026-7881-Concrete CMS is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block

concretecms/concretecms · GHSA-chfm-cm6h-q5x7

low2026-05-22

CVE-2026-7882-Concrete CMS is vulnerable to unauthorized file deletion

concretecms/concretecms · GHSA-66rg-92q4-6m8q

medium2026-05-22

CVE-2026-8236-Concrete CMS is vulnerable to IDOR combined with a missing authentication gate

concretecms/concretecms · GHSA-58c8-vvqw-cm7m

medium2026-05-22

CVE-2026-8239-Concrete CMS is vulnerable to IDOR

concretecms/concretecms · GHSA-2xp7-rpvc-pjwc

high2026-05-21

CVE-2026-46701-Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

jovancoding/network-ai · GHSA-j3vx-cx2r-pvg8