Login Request a demo
CC
Product
Craft Cms
by Craftcms · last CVE Mar 24, 2026
On CISA KEVExploited in the wild
97
CVEs
4
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities97In the news2Timeline
Severity mix
Critical 11High 31Medium 55Low 0
Severity
All severities97Critical11High31Medium55Low0
Exploitation
On CISA KEV4Exploited in the wild4
Watch

Add Craft Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-32432
In wildKEV
10.0
100%
Apr 25
Craft CMS Allows Remote Code Execution
Affected: 3.0.0 before 3.9.15; 4.0.0 before 4.14.15; 5.0.0 before 5.6.17
CVE-2024-56145
In wildKEV
9.8
97%
Dec 18
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
Affected: 3.0.0 before 3.9.14; 4.0.0 before 4.13.2; 5.0.0 before 5.5.2
CVE-2025-23209
In wildKEV
8.1
22%
Jan 18
Potential RCE with a compromised security key in craft/cms
Affected: after 4.0.0 before 4.13.8; after 5.0.0 before 5.5.8; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2025-35939
In wildKEV
5.3
1%
May 7
Craft CMS stores user-provided content in session files
Affected: before 4.15.3; 5.0.0 before 5.7.5
CVE-2026-32267
9.8
9%
Mar 16
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Affected: 4.0.0.1 before 4.17.6; 5.0.1 before 5.9.12; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2024-37843
9.8
53%
Jun 25
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint
Affected: before 3.7.31
CVE-2023-41892
9.8
94%
Sep 13
Craft CMS is a platform for creating digital experiences
Affected: 4.4.0 before 4.4.15
CVE-2021-27903
9.8
3%
Jun 30
An issue was discovered in Craft CMS before 3.6.7
Affected: before 3.6.7
CVE-2020-9757
9.8
73%
Mar 4
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller
Affected: before 3.3.0
CVE-2019-15929
9.8
2%
Oct 24
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them
Affected: through 3.1.7
CVE-2026-28783
9.1
0%
Mar 4
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-28697
9.1
1%
Mar 4
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2025-68456
9.1
1%
Jan 5
Craft is a platform for creating digital experiences
Affected: 3.0.0 before 4.16.17; 5.0.1 before 5.8.21; 5.0.0; 5.0.0
CVE-2026-31858
8.8
0%
Mar 11
Craft is a content management system (CMS)
Affected: 5.0.1 before 5.9.9; 5.0.0; 5.0.0
CVE-2026-31857
8.8
1%
Mar 11
Craft is a content management system (CMS)
Affected: 4.0.0.1 before 4.17.4; 5.0.1 before 5.9.9; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +6 more
CVE-2026-25497
8.8
0%
Feb 9
Craft is a platform for creating digital experiences
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-25495
8.8
1%
Feb 9
Craft is a platform for creating digital experiences
Affected: after 4.0.0 before 4.16.18; after 5.0.0 before 5.8.22; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2025-68454
8.8
1%
Jan 5
Craft is a platform for creating digital experiences
Affected: 4.0.0.1 before 4.16.17; 5.0.1 before 5.8.21; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2025-54417
8.8
0%
Aug 9
Craft is a platform for creating digital experiences
Affected: 4.13.8 before 4.16.3; 5.5.8 before 5.8.4
CVE-2024-21622
8.8
1%
Jan 3
Craft is a content management system
Affected: 3.0.0 before 3.9.6; 4.0.0 through 4.5.15
CVE-2023-30130
8.8
1%
May 12
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter
Affected: 3.8.1
CVE-2022-29933
8.8
5%
May 9
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a…
Affected: through 3.7.36
CVE-2021-41824
8.8
1%
Sep 30
Craft CMS before 3.7.14 allows CSV injection
Affected: 3.4.0 before 3.7.14
CVE-2018-3814
8.8
2%
Jan 1
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg…
Affected: 2.6.3000
CVE-2026-28696
7.5
0%
Mar 4
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2024-41800
7.5
0%
Jul 25
Craft is a content management system (CMS)
Affected: 5.0.1 before 5.2.3; 5.0.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +7 more
CVE-2023-36260
7.5
1%
Jan 30
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS
Affected: before 4.6.1.1
CVE-2022-37783
7.5
1%
Dec 5
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens
Affected: 3.0.0 through 3.7.32
CVE-2026-33157
7.2
1%
Mar 24
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
Affected: 5.6.0 before 5.9.13
CVE-2026-32264
7.2
1%
Mar 16
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Affected: 4.0.0.1 before 4.17.5; 5.0.1 before 5.9.11; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-32263
7.2
1%
Mar 16
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Affected: 5.6.0 before 5.9.11
CVE-2026-28784
7.2
1%
Mar 4
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-28695
7.2
1%
Mar 4
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-25498
7.2
1%
Feb 9
Craft is a platform for creating digital experiences
Affected: after 4.0.0 before 4.16.18; after 5.0.0 before 5.8.22; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2025-68455
7.2
1%
Jan 5
Craft is a platform for creating digital experiences
Affected: 4.0.0.1 before 4.16.17; 5.0.1 before 5.8.21; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2025-57811
7.2
1%
Aug 25
Craft is a platform for creating digital experiences
Affected: 4.1.0 before 4.16.6; 5.1.0 before 5.8.7; 4.0.0; 4.0.0; 4.0.0; 5.0.0
CVE-2025-46731
7.2
2%
May 5
Craft is a content management system
Affected: 4.1.0 before 4.14.13; 5.1.0 before 5.6.15; 4.0.0; 4.0.0; 4.0.0; 5.0.0
CVE-2024-52291
7.2
1%
Nov 13
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.12.5; after 5.0.0 before 5.4.6; 4.0.0; 4.0.0; 4.0.0; 5.0.0
CVE-2024-52293
7.2
1%
Nov 13
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.12.2; after 5.0.0 before 5.4.3; 4.0.0; 4.0.0; 4.0.0; 5.0.0
CVE-2023-40035
7.2
2%
Aug 23
Craft is a CMS for creating custom digital experiences on the web and beyond
Affected: 3.0.0 before 3.8.15; 4.0.0 before 4.4.15; 4.0.0
CVE-2023-30179
7.2
2%
Jun 13
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI)
Affected: 3.7.59
CVE-2023-32679
7.2
2%
May 19
Craft CMS is an open source content management system
Affected: 4.0.0 before 4.4.6
CVE-2018-20465
7.2
2%
Dec 25
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for…
Affected: through 3.0.34
CVE-2025-68437
6.8
0%
Jan 5
Craft is a platform for creating digital experiences
Affected: 3.5.0 before 4.16.17; 5.0.1 before 5.8.21; 5.0.0; 5.0.0
CVE-2026-33162
6.5
0%
Mar 24
Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions
Affected: 5.3.0 before 5.9.14
CVE-2026-33159
6.5
0%
Mar 24
Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
Affected: after 4.0.0 before 4.17.8; after 5.0.0 before 5.9.14; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-33158
6.5
0%
Mar 24
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Affected: after 4.0.0 before 4.17.8; after 5.0.0 before 5.9.14; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-28781
6.5
0%
Mar 4
Craft is a content management system (CMS)
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-27129
6.5
0%
Feb 24
Craft is a content management system (CMS)
Affected: 3.5.0 before 4.16.19; 5.0.1 before 5.8.23; 5.0.0; 5.0.0
CVE-2026-25494
6.5
0%
Feb 9
Craft is a platform for creating digital experiences
Affected: after 4.0.0 before 4.16.18; after 5.0.0 before 5.8.22; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +1 more
Page 1 of 2 · 97 total
12