CM
Product
cms
On CISA KEVExploited in the wild
107
CVEs
3
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 7High 47Medium 53Low 0
Watch
Add cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-55791 | 6.9 | Jul 1 | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs Affected: >= 5.0.0-RC1, < 5.10.0; >= 4.0.0-RC1, < 4.18.0 |
| CVE-2026-112771 | 6.5 | Oct 19 | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters Affected: 4.0.0 before 4.18.8; 5.0.0 before 5.11.0 |
| CVE-2026-86731 | 6.5 | Sep 8 | Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController Affected: 5.0.0-RC1 before 5.10.12 |
| CVE-2026-72786 | 6.5 | Aug 12 | Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset Affected: 5.0.0-RC1 before 5.10.8 |
| CVE-2026-72782 | 6.5 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-72780 | 6.5 | Aug 11 | Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey Affected: 5.0.0-RC1 before 5.10.5 |
| CVE-2026-56394 | 6.5 | Jun 21 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter Affected: 4.0.0-RC1 before 4.17.7; 5.0.0-RC1 before 5.9.13 |
| CVE-2026-33162 | 6.5 | Mar 24 | Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions Affected: >= 5.3.0, < 5.9.14 |
| CVE-2026-33159 | 6.5 | Mar 24 | Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-33158 | 6.5 | Mar 24 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-28781 | 6.5 | Mar 4 | Craft Affected by Entries Authorship Spoofing via Mass Assignment Affected: >= 5.0.0-RC1, < 5.9.0-beta.1; >= 4.0.0-RC1, < 4.17.0-beta.1 |
| CVE-2026-27129 | 6.5 | Feb 24 | Cloud Metadata SSRF Protection Bypass via IPv6 Resolution Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-72787 | 6.4 | Aug 12 | Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name Affected: 5.0.0-RC1 before 5.10.8 |
| CVE-2026-84797 | 6.3 | Sep 2 | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-27127 | 6.3 | Feb 24 | Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-72783 | 6.2 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-31859 | 6.1 | Mar 11 | Craft has Reflective XSS via incomplete return URL sanitization Affected: >= 4.15.3, < 4.17.3; >= 5.7.5, < 5.9.7 |
| CVE-2026-50280 | 6.0 | Jul 1 | Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check Affected: >= 5.0.0-RC1, < 5.9.21 |
| CVE-2026-55792 | 6.0 | Jul 1 | Craft CMS: Sensitive File Disclosure / Server-Side File Read Affected: >= 4.0.0-RC1, < 4.18.0; >= 5.0.0-RC1, < 5.10.0 |
| CVE-2026-109306 | 5.9 | Oct 12 | Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition Affected: 5.0.0 before 5.10.14 |
| CVE-2026-92591 | 5.9 | Sep 16 | Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer Affected: 5.0.0 before 5.10.13 |
| CVE-2026-55793 | 5.9 | Jul 1 | Craft CMS: Stored XSS via Structure entry title in table view Affected: >= 5.0.0-RC1, < 5.9.23 |
| CVE-2026-41130 | 5.5 | Apr 21 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint Affected: >= 5.0.0-RC1, < 5.9.15; >= 4.0.0-RC1, < 4.17.9 |
| CVE-2026-41129 | 5.5 | Apr 21 | Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations Affected: >= 5.0.0-RC1, < 5.9.15; >= 4.0.0-RC1, < 4.17.9 |
| CVE-2026-92590 | 5.4 | Sep 16 | Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields Affected: 5.7.0 before 5.10.13 |
| CVE-2026-72784 | 5.4 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-33051 | 5.4 | Mar 20 | Craft CMS Vulnerable to Stored XSS in Revision Context Menu Affected: >= 5.9.0-beta.1, < 5.9.11 |
| CVE-2026-50283 | 5.3 | Jul 1 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement Affected: >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, < 4.17.14 |
| CVE-2026-41128 | 5.3 | Apr 21 | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action Affected: >= 5.6.0, < 5.9.15 |
| CVE-2026-33160 | 5.3 | Mar 24 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-29069 | 5.3 | Mar 4 | Craft has an unauthenticated activation email trigger with potential user enumeration Affected: >= 5.0.0-RC1, < 5.9.0-beta.2; >= 4.0.0-RC1, < 4.17.0-beta.2 |
| CVE-2026-109304 | 4.9 | Oct 12 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument Affected: 4.0.0 before 4.18.7; 5.0.0 before 5.10.14 |
| CVE-2026-50282 | 4.9 | Jul 2 | Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves Affected: >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, <= 4.17.14 |
| CVE-2026-84793 | 4.8 | Sep 2 | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-56393 | 4.8 | Jun 21 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options Affected: 5.0.0-RC1 before 5.9.0-beta.1; 4.0.0-RC1 before 4.17.0-beta.1 |
| CVE-2026-56383 | 4.8 | Jun 21 | Craft CMS - Stored XSS in Table Field via Row Heading Column Type Affected: 4.5.0-beta.1 before 4.16.19; 5.0.0-RC1 before 5.8.23 |
| CVE-2026-56381 | 4.8 | Jun 21 | Craft CMS - Stored XSS via User Group Name in User Permissions Page Affected: 5.0.0-RC1 before 5.8.22 |
| CVE-2026-27128 | 4.8 | Feb 24 | Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-27126 | 4.8 | Feb 24 | Craft CMS has Stored XSS in Table Field via "HTML" Column Type Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2024-45406 | 4.8 | Sep 9 | Craft CMS stored XSS in breadcrumb list and title fields Affected: >= 5.0.0, < 5.1.2 |
| CVE-2026-109307 | 4.7 | Oct 12 | Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification Affected: 5.0.0 before 5.10.14 |
| CVE-2026-72779 | 4.5 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-92589 | 4.3 | Sep 16 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder Affected: 5.0.0 before 5.10.13 |
| CVE-2026-84802 | 4.3 | Sep 2 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController Affected: 5.7.0 before 5.10.12 |
| CVE-2026-84799 | 4.3 | Sep 2 | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations Affected: 5.0.0-RC1 before 5.11.0 |
| CVE-2026-84792 | 4.3 | Sep 2 | Craft CMS before 5.10.11 Broken Access Control via element-indexes Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-72785 | 4.3 | Aug 11 | Craft CMS before 5.10.6 Authorization Bypass via structures/move-element Affected: 5.0.0-RC1 before 5.10.6 |
| CVE-2026-56385 | 4.3 | Jun 21 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint Affected: 5.0.0-RC1 before 5.9.14; 4.0.0-RC1 before 4.17.8 |
| CVE-2026-56384 | 4.3 | Jun 21 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint Affected: 4.0.0-RC1 before 4.17.8; 5.0.0-RC1 before 5.9.14 |
| CVE-2026-33161 | 4.3 | Mar 24 | Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |