How many CVEs does concrete5 have?

concrete5 has 26 published CVE records since 2011, including 2 in the last two years.

How many concrete5 CVEs are in CISA KEV?

None of concrete5's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which concrete5 products have the most CVEs?

The concrete5 products with the most published CVEs are concrete5, concrete5/concrete5, concrete5/core, concrete5-legacy, concrete.

What are the most common weakness types in concrete5 CVEs?

concrete5's CVEs most often map to these CWE weakness types: CWE-918 (Server-Side Request Forgery (SSRF)), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-502 (Deserialization of Untrusted Data).

Are there public exploits for concrete5 vulnerabilities?

Yes — 6 of concrete5's CVEs have a known public exploit.

How many critical concrete5 vulnerabilities are there?

concrete5 has 1 critical and 7 high-severity CVEs.

What is the average severity of concrete5 CVEs?

The average CVSS base score across concrete5's scored CVEs is 6.1.

RadicalNotion.AI

Log in Start free

26 CVEs

concrete5 Vulnerabilities

Name: concrete5 vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for concrete5.

26

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

6

Public exploits

PoC or exploit code

6.1

Avg CVSS

2011–2026

Overview

concrete5 has 26 published CVE records since 2011, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 6 have a known public exploit. The average CVSS base score across scored CVEs is 6.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting concrete5 products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on concrete5's vulnerability posture, as a share of its 26 published CVEs.

Average CVSS: 6.1
Critical / high: 31%
Actively exploited (KEV): 0%
Public exploit available: 23%
Patch available: 77%

Severity and exploitation

How the CVSS severity of concrete5's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High7

Medium17

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of concrete5's CVEs are currently listed in CISA's KEV catalog.

Public exploits

6

6 of concrete5's CVEs have a known public exploit available.

Most affected products

The concrete5 products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in concrete5 CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish concrete5 CVE records.

Disclosure activity by year

How many concrete5 CVEs were published each year.

2015

3

2017

3

2018

1

2020

2

2021

7

2022

1

2023

3

2026

2

Latest concrete5 CVEs

The most recently disclosed vulnerabilities affecting concrete5.

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
CWE-502
High · CVSS 8.4
EPSS 0.1%2026-06-10
Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()
CWE-862
Medium · CVSS 6.3
EPSS 0.2%2026-05-21
Medium vulnerability · 2023-04-28
Medium · CVSS 5.4
EPSS 0.6%2023-04-28
Medium vulnerability · 2023-04-28
Medium · CVSS 6.1
EPSS 0.6%2023-04-28
Medium vulnerability · 2023-04-28
CWE-640
Medium · CVSS 5.3
EPSS 0.7%2023-04-28
High vulnerability · 2022-02-09
CWE-352
High · CVSS 8.8
EPSS 0.5%2022-02-09
High vulnerability · 2021-11-19
CWE-639
High · CVSS 7.5
EPSS 1.1%2021-11-19
High vulnerability · 2021-11-19
CWE-639
High · CVSS 7.5
EPSS 1.1%2021-11-19
High vulnerability · 2021-11-19
High · CVSS 8.8
EPSS 0.9%2021-11-19
High vulnerability · 2021-11-19
CWE-918
High · CVSS 7.5
EPSS 1.4%2021-11-19
Medium vulnerability · 2021-11-19
CWE-918
Medium · CVSS 5.3
EPSS 0.8%2021-11-19
Critical vulnerability · 2021-10-07
CWE-918
Critical · CVSS 9.8
EPSS 1.2%2021-10-07

Track new concrete5 CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor concrete5 CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,673 CVEs linux22,774 CVEs Google16,481 CVEs Apple15,095 CVEs Oracle12,708 CVEs Debian10,226 CVEs IBM8,839 CVEs Red Hat8,111 CVEs

Browse all vendors

Frequently asked questions

Common questions about concrete5 vulnerabilities.

How many CVEs does concrete5 have?: concrete5 has 26 published CVE records since 2011, including 2 in the last two years.
How many concrete5 CVEs are in CISA KEV?: None of concrete5's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which concrete5 products have the most CVEs?: The concrete5 products with the most published CVEs are concrete5, concrete5/concrete5, concrete5/core, concrete5-legacy, concrete.
What are the most common weakness types in concrete5 CVEs?: concrete5's CVEs most often map to these CWE weakness types: CWE-918 (Server-Side Request Forgery (SSRF)), CWE-639 (Authorization Bypass Through User-Controlled Key), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-502 (Deserialization of Untrusted Data).
Are there public exploits for concrete5 vulnerabilities?: Yes — 6 of concrete5's CVEs have a known public exploit.
How many critical concrete5 vulnerabilities are there?: concrete5 has 1 critical and 7 high-severity CVEs.
What is the average severity of concrete5 CVEs?: The average CVSS base score across concrete5's scored CVEs is 6.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track concrete5 vulnerabilities

Monitor new concrete5 vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing