CM
Product
cms
On CISA KEVExploited in the wild
120
CVEs
3
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 8High 52Medium 60Low 0
Watch
Add cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25498 | 7.2 | Feb 9 | Craft has a potential authenticated Remote Code Execution via malicious attached Behavior Affected: >= 5.0.0-RC1, < 5.8.22; >= 4.0.0-RC1, < 4.16.18 |
| CVE-2025-68455 | 7.2 | Jan 5 | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior Affected: >= 5.0.0-RC1, < 5.8.21; >= 4.0.0-RC1, < 4.16.17 |
| CVE-2026-79991 | 7.1 | Sep 2 | Authenticated SQL Injection via nested eager-loading criteria Affected: 5.0.0-RC1 before 5.10.13 |
| CVE-2026-84800 | 7.1 | Sep 2 | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-84798 | 7.1 | Sep 2 | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-84794 | 7.1 | Sep 2 | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-50281 | 7.1 | Jul 2 | Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements Affected: >= 5.7.0, < 5.9.21 |
| CVE-2026-50284 | 7.1 | Jul 1 | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets Affected: =>= 5.0.0-RC1, < 5.9.22; >= 4.0.0-RC1, < 4.17.15 |
| CVE-2026-44012 | 7.1 | May 12 | Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure Affected: >= 5.0.0-RC1, < 5.9.18 |
| CVE-2026-44010 | 7.1 | May 12 | Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure Affected: >= 5.0.0, < 5.9.18; >= 4.0.0, < 4.17.12 |
| CVE-2026-55791 | 6.9 | Jul 1 | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs Affected: >= 5.0.0-RC1, < 5.10.0; >= 4.0.0-RC1, < 4.18.0 |
| CVE-2025-68437 | 6.8 | Jan 5 | Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation Affected: >= 5.0.0-RC1, < 5.8.21; >= 4.0.0-RC1, < 4.16.17 |
| CVE-2026-112771 | 6.5 | Oct 19 | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters Affected: 4.0.0 before 4.18.8; 5.0.0 before 5.11.0 |
| CVE-2026-86731 | 6.5 | Sep 8 | Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController Affected: 5.0.0-RC1 before 5.10.12 |
| CVE-2026-72786 | 6.5 | Aug 12 | Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset Affected: 5.0.0-RC1 before 5.10.8 |
| CVE-2026-72782 | 6.5 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-72780 | 6.5 | Aug 11 | Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey Affected: 5.0.0-RC1 before 5.10.5 |
| CVE-2026-56394 | 6.5 | Jun 21 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter Affected: 4.0.0-RC1 before 4.17.7; 5.0.0-RC1 before 5.9.13 |
| CVE-2026-33162 | 6.5 | Mar 24 | Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions Affected: >= 5.3.0, < 5.9.14 |
| CVE-2026-33159 | 6.5 | Mar 24 | Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-33158 | 6.5 | Mar 24 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-28781 | 6.5 | Mar 4 | Craft Affected by Entries Authorship Spoofing via Mass Assignment Affected: >= 5.0.0-RC1, < 5.9.0-beta.1; >= 4.0.0-RC1, < 4.17.0-beta.1 |
| CVE-2026-27129 | 6.5 | Feb 24 | Cloud Metadata SSRF Protection Bypass via IPv6 Resolution Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-25494 | 6.5 | Feb 9 | Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation Affected: >= 5.0.0-RC1, < 5.8.22 |
| CVE-2026-25493 | 6.5 | Feb 9 | Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect Affected: >= 5.0.0-RC1, < 5.8.22; >= 4.0.0-RC1, < 4.16.18 |
| CVE-2026-25492 | 6.5 | Feb 9 | Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host Affected: >= 5.0.0-RC1, < 5.8.22; >= 3.5.0, < 4.16.18 |
| CVE-2025-68436 | 6.5 | Jan 5 | Craft CMS vulnerable to potential information disclosure via unchecked asset relocation Affected: >= 5.0.0-RC1, < 5.8.21; >= 4.0.0-RC1, < 4.16.17 |
| CVE-2026-72787 | 6.4 | Aug 12 | Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name Affected: 5.0.0-RC1 before 5.10.8 |
| CVE-2026-84797 | 6.3 | Sep 2 | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-27127 | 6.3 | Feb 24 | Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-72783 | 6.2 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-31859 | 6.1 | Mar 11 | Craft has Reflective XSS via incomplete return URL sanitization Affected: >= 4.15.3, < 4.17.3; >= 5.7.5, < 5.9.7 |
| CVE-2026-50280 | 6.0 | Jul 1 | Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check Affected: >= 5.0.0-RC1, < 5.9.21 |
| CVE-2026-55792 | 6.0 | Jul 1 | Craft CMS: Sensitive File Disclosure / Server-Side File Read Affected: >= 4.0.0-RC1, < 4.18.0; >= 5.0.0-RC1, < 5.10.0 |
| CVE-2026-109306 | 5.9 | Oct 12 | Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition Affected: 5.0.0 before 5.10.14 |
| CVE-2026-92591 | 5.9 | Sep 16 | Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer Affected: 5.0.0 before 5.10.13 |
| CVE-2026-55793 | 5.9 | Jul 1 | Craft CMS: Stored XSS via Structure entry title in table view Affected: >= 5.0.0-RC1, < 5.9.23 |
| CVE-2026-41130 | 5.5 | Apr 21 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint Affected: >= 5.0.0-RC1, < 5.9.15; >= 4.0.0-RC1, < 4.17.9 |
| CVE-2026-41129 | 5.5 | Apr 21 | Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations Affected: >= 5.0.0-RC1, < 5.9.15; >= 4.0.0-RC1, < 4.17.9 |
| CVE-2026-92590 | 5.4 | Sep 16 | Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields Affected: 5.7.0 before 5.10.13 |
| CVE-2026-72784 | 5.4 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-33051 | 5.4 | Mar 20 | Craft CMS Vulnerable to Stored XSS in Revision Context Menu Affected: >= 5.9.0-beta.1, < 5.9.11 |
| CVE-2026-50283 | 5.3 | Jul 1 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement Affected: >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, < 4.17.14 |
| CVE-2026-41128 | 5.3 | Apr 21 | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action Affected: >= 5.6.0, < 5.9.15 |
| CVE-2026-33160 | 5.3 | Mar 24 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-29069 | 5.3 | Mar 4 | Craft has an unauthenticated activation email trigger with potential user enumeration Affected: >= 5.0.0-RC1, < 5.9.0-beta.2; >= 4.0.0-RC1, < 4.17.0-beta.2 |
| CVE-2026-109304 | 4.9 | Oct 12 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument Affected: 4.0.0 before 4.18.7; 5.0.0 before 5.10.14 |
| CVE-2026-50282 | 4.9 | Jul 2 | Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves Affected: >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, <= 4.17.14 |
| CVE-2026-84793 | 4.8 | Sep 2 | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-56393 | 4.8 | Jun 21 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options Affected: 5.0.0-RC1 before 5.9.0-beta.1; 4.0.0-RC1 before 4.17.0-beta.1 |