CM
Product
cms
On CISA KEVExploited in the wild
120
CVEs
3
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 8High 52Medium 60Low 0
Watch
Add cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-56383 | 4.8 | Jun 21 | Craft CMS - Stored XSS in Table Field via Row Heading Column Type Affected: 4.5.0-beta.1 before 4.16.19; 5.0.0-RC1 before 5.8.23 |
| CVE-2026-56381 | 4.8 | Jun 21 | Craft CMS - Stored XSS via User Group Name in User Permissions Page Affected: 5.0.0-RC1 before 5.8.22 |
| CVE-2026-27128 | 4.8 | Feb 24 | Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-27126 | 4.8 | Feb 24 | Craft CMS has Stored XSS in Table Field via "HTML" Column Type Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-25496 | 4.8 | Feb 9 | Craft has a stored XSS in Number Prefix & Suffix Fields Affected: >= 5.0.0-RC1, < 5.8.22; >= 4.0.0-RC1, < 4.16.18 |
| CVE-2026-25491 | 4.8 | Feb 9 | Craft has a Stored XSS in Entry Types Name Affected: >= 5.0.0-RC1, < 5.8.22 |
| CVE-2024-45406 | 4.8 | Sep 9 | Craft CMS stored XSS in breadcrumb list and title fields Affected: >= 5.0.0, < 5.1.2 |
| CVE-2026-109307 | 4.7 | Oct 12 | Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification Affected: 5.0.0 before 5.10.14 |
| CVE-2026-72779 | 4.5 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-92589 | 4.3 | Sep 16 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder Affected: 5.0.0 before 5.10.13 |
| CVE-2026-84802 | 4.3 | Sep 2 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController Affected: 5.7.0 before 5.10.12 |
| CVE-2026-84799 | 4.3 | Sep 2 | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations Affected: 5.0.0-RC1 before 5.11.0 |
| CVE-2026-84792 | 4.3 | Sep 2 | Craft CMS before 5.10.11 Broken Access Control via element-indexes Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-72785 | 4.3 | Aug 11 | Craft CMS before 5.10.6 Authorization Bypass via structures/move-element Affected: 5.0.0-RC1 before 5.10.6 |
| CVE-2026-56385 | 4.3 | Jun 21 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint Affected: 5.0.0-RC1 before 5.9.14; 4.0.0-RC1 before 4.17.8 |
| CVE-2026-56384 | 4.3 | Jun 21 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint Affected: 4.0.0-RC1 before 4.17.8; 5.0.0-RC1 before 5.9.14 |
| CVE-2026-33161 | 4.3 | Mar 24 | Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-32262 | 4.3 | Mar 16 | Craft CMS has a Path Traversal Vulnerability in AssetsController Affected: >= 4.0.0-RC1, < 4.17.5; >= 5.0.0-RC1, < 5.9.11 |
| CVE-2026-29113 | 4.3 | Mar 10 | Craft has a potential information disclosure vulnerability in preview tokens Affected: >= 4.0.0-RC1, < 4.17.3; >= 5.0.0-RC1, < 5.9.7 |
| CVE-2026-28782 | 4.3 | Mar 4 | Craft has a Permission Bypass and IDOR in Duplicate Entry Action Affected: >= 5.0.0-RC1, < 5.9.0-beta.1; >= 4.0.0-RC1, < 4.17.0-beta.1 |