Login Request a demo
CI
Product
CiviCRM
by CiviCRM · last CVE Aug 11, 2026
11
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 1High 2Medium 3Low 0
Severity
All severities11Critical1High2Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add CiviCRM to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-65187
6.1
0%
Dec 2
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field
Affected: before 6.7.0
CVE-2023-25440
5.4
3%
May 23
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field
Affected: 5.59
CVE-2020-36389
4.3
1%
Jun 17
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF
Affected: before 5.27.5; before 5.28.1
Showing 3