CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,088 CVEs published, 233 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,088
Show in the list
Critical, last 7 days
233
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product concrete_cms:concrete_cms. Show all products

117 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-3452High 8.9Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block.
Assigned by ConcreteCMS
Mar 3, 2026
CVE-2026-3244Medium 4.8Concrete CMS below version 9.4.8 is vulnerable to Stored XSS in Search Results via Page Names
Assigned by ConcreteCMS
Mar 3, 2026
CVE-2026-3242Medium 4.8Concrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language block
Assigned by ConcreteCMS
Mar 3, 2026
CVE-2026-3241Medium 4.8Concrete CMS below version 9.4.8 is vulnerable to a stored cross-site scripting (XSS) in the "Legacy Form" block.
Assigned by ConcreteCMS
Mar 3, 2026
CVE-2026-3240Medium 4.8Concrete CMS below 9.4.8 is vulnerable to Stored XSS via Legacy form
Assigned by ConcreteCMS
Mar 3, 2026
CVE-2026-2994Low 2.3Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group
Assigned by ConcreteCMS
Mar 3, 2026
CVE-2026-8134Critical 9.4Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemplate Path Traversal leading to PHP File Inclusion
Assigned by ConcreteCMS
May 21, 2026
CVE-2026-8135High 8.9Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.
Assigned by ConcreteCMS
May 21, 2026
CVE-2026-8417High 7.5Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller
Assigned by ConcreteCMS
May 21, 2026
CVE-2026-8140High 7.5Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller
Assigned by ConcreteCMS
May 21, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.