Skip to content
OpenAdvisories

Archive

21 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /21 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-8337 Public exploit

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private surveys are present on the site. An unauthenticated attacker can vote in the restricted survey by su…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 6.3
    CVE-2026-8237 Public exploit Scanner template

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint

    Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/ccm/frontend/conversations/message_detail` endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from re…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 6.3
    CVE-2026-8239 Public exploit

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'

    Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with …

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 6.9
    CVE-2026-6826 Public exploit Scanner template

    Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller

    Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.  Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of eve…

    Concrete CMS Concrete CMS concrete5/concrete5 Packagist
  • Medium 6.7
    CVE-2026-34926 Exploited Public exploit EPSS 13%

    A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker …

    Trend Micro TrendAI Apex One as a Service TrendAI Apex One
    KEV May 21, 2026