Concrete CMS is vulnerable to IDOR
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8239 · GHSA-2xp7-rpvc-pjwc
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
26–37 of 37 matching · newest first
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8239 · GHSA-2xp7-rpvc-pjwc
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8327 · GHSA-wmw3-3fv3-h54w
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8139 · GHSA-pcrh-gj77-j4mw
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8236 · GHSA-58c8-vvqw-cm7m
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-7879 · GHSA-fqg3-8w8r-8g94
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-7886 · GHSA-p8p9-5953-h9jw
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8237 · GHSA-xpgc-7vc2-8725
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-7881 · GHSA-chfm-cm6h-q5x7
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-7887 · GHSA-f54h-78c9-c24h
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8238 · GHSA-qv3x-mffx-9gw8
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-7882 · GHSA-66rg-92q4-6m8q
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8240 · GHSA-vpgr-cwfx-pwfw
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.