Login Request a demo
CC
Product
Craft Cms
by Craftcms · last CVE Mar 24, 2026
On CISA KEVExploited in the wild
97
CVEs
4
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities97In the news2Timeline
Severity mix
Critical 11High 31Medium 55Low 0
Severity
All severities97Critical11High31Medium55Low0
Exploitation
On CISA KEV4Exploited in the wild4
Watch

Add Craft Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-25493
6.5
0%
Feb 9
Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect
Affected: after 4.0.0 before 4.16.18; after 5.0.0 before 5.8.22; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-25492
6.5
0%
Feb 9
Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Affected: 3.5.0 before 4.16.18; 5.0.0 before 5.8.22
CVE-2025-68436
6.5
0%
Jan 5
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
Affected: 4.0.0.1 before 4.16.17; 5.0.1 before 5.8.21; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2024-52292
6.5
1%
Nov 13
Craft is a content management system (CMS)
Affected: 3.5.13 before 4.12.8; 5.0.0 before 5.4.9
CVE-2026-27127
6.3
0%
Feb 24
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Affected: 3.5.1 before 4.16.19; 5.0.1 before 5.8.23; 3.5.0; 5.0.0; 5.0.0
CVE-2026-31859
6.1
0%
Mar 11
Craft has Reflective XSS via incomplete return URL sanitization
Affected: 4.15.3 before 4.17.3; 5.7.5 before 5.9.7
CVE-2023-33495
6.1
0%
Jun 20
Craft CMS through 4.4.9 is vulnerable to HTML Injection
Affected: through 4.4.9
CVE-2023-33195
6.1
1%
May 27
Craft is a CMS for creating custom digital experiences on the web
Affected: 4.3.0 before 4.4.6
CVE-2023-31144
6.1
0%
May 9
Craft CMS is a content management system
Affected: 3.0.0 through 3.8.3; 4.0.0 through 4.4.3
CVE-2023-30177
6.1
0%
Apr 25
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS)
Affected: 3.7.59
CVE-2022-28378
6.1
1%
Apr 3
Craft CMS before 3.7.29 allows XSS
Affected: before 3.7.29
CVE-2021-27902
6.1
1%
Jun 30
An issue was discovered in Craft CMS before 3.6.0
Affected: before 3.6.0
CVE-2021-32470
6.1
1%
May 7
Craft CMS before 3.6.13 has an XSS vulnerability
Affected: before 3.6.13
CVE-2019-9554
6.1
4%
Dec 31
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI
Affected: 3.1.12
CVE-2019-17496
6.1
1%
Oct 11
Craft CMS before 3.3.8 has stored XSS via a name field
Affected: before 3.3.8
CVE-2019-12823
6.1
1%
Jun 18
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS
Affected: before 3.1.31
CVE-2017-8384
6.1
1%
May 1
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based
Affected: through 2.6.2974
CVE-2017-8052
6.1
1%
Apr 22
Craft CMS before 2.6.2974 allows XSS attacks
Affected: through 2.6.2973
CVE-2026-33051
5.4
0%
Mar 20
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
Affected: 5.9.0 before 5.9.11
CVE-2023-36259
5.4
0%
Jan 30
Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation
Affected: before 3.0.2
CVE-2023-33196
5.4
1%
May 26
Craft is a CMS for creating custom digital experiences
Affected: 4.0.1 before 4.4.7; 4.0.0; 4.0.0; 4.0.0; 4.0.0
CVE-2023-33197
5.4
1%
May 26
Craft is a CMS for creating custom digital experiences on the web
Affected: before 4.4.6
CVE-2023-2817
5.4
0%
May 26
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11
Affected: through 4.4.11
CVE-2023-23927
5.4
1%
Mar 3
Craft is a platform for creating digital experiences
Affected: before 4.3.7
CVE-2022-37246
5.4
1%
Sep 21
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label
Affected: 4.2.0.1
CVE-2022-37251
5.4
1%
Sep 16
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts
Affected: 4.2.0.1
CVE-2022-37247
5.4
1%
Sep 16
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page
Affected: 4.2.0.1
CVE-2022-37248
5.4
1%
Sep 16
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php
Affected: 4.2.0.1
CVE-2022-37250
5.4
1%
Sep 16
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount
Affected: 4.2.0.1
CVE-2020-19626
5.4
1%
Mar 26
Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new
Affected: 3.1.31
CVE-2017-9516
5.4
3%
Jun 8
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file
Affected: through 2.6.2981
CVE-2026-33160
5.3
0%
Mar 24
Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL
Affected: after 4.0.0 before 4.17.8; after 5.0.0 before 5.9.14; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-29069
5.3
0%
Mar 4
Craft has an unauthenticated activation email trigger with potential user enumeration
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +4 more
CVE-2019-14280
5.3
9%
Jul 26
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing…
Affected: 2.0.2524 before 2.7.10; 3.0.0 before 3.2.6
CVE-2017-8385
5.3
1%
May 1
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message
Affected: through 2.6.2974
CVE-2017-8383
5.3
1%
May 1
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder
Affected: through 2.6.2974
CVE-2026-27128
4.8
0%
Feb 24
Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit
Affected: after 4.5.0 before 4.16.19; after 5.0.0 before 5.8.23; 4.5.0; 4.5.0; 5.0.0; 5.0.0
CVE-2026-27126
4.8
0%
Feb 24
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
Affected: after 4.5.0 before 4.16.19; after 5.0.0 before 5.8.23; 4.5.0; 4.5.0; 5.0.0; 5.0.0
CVE-2026-25496
4.8
0%
Feb 9
Craft has a stored XSS in Number Prefix & Suffix Fields
Affected: after 4.0.0 before 4.16.18; after 5.0.0 before 5.8.22; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-25491
4.8
0%
Feb 9
Craft has a Stored XSS in Entry Types Name
Affected: 5.0.0 before 5.8.21
CVE-2024-45406
4.8
0%
Sep 9
Craft CMS stored XSS in breadcrumb list and title fields
Affected: 5.0.0 before 5.1.2
CVE-2023-33194
4.8
1%
May 26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an…
Affected: 3.0.0 before 3.8.6; 4.0.1 before 4.4.6
CVE-2018-20418
4.8
4%
Dec 24
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab
Affected: 3.0.25
CVE-2026-33161
4.3
0%
Mar 24
Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
Affected: after 4.0.0 before 4.17.8; after 5.0.0 before 5.9.14; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-32262
4.3
0%
Mar 16
Craft CMS has a Path Traversal Vulnerability in AssetsController
Affected: 4.0.0.1 before 4.17.5; 5.0.1 before 5.9.11; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
CVE-2026-29113
4.3
0%
Mar 10
Craft has a potential information disclosure vulnerability in preview tokens
Affected: 4.0.0 before 4.17.4; 5.0.0 before 5.9.7
CVE-2026-28782
4.3
0%
Mar 4
Craft has a Permission Bypass and IDOR in Duplicate Entry Action
Affected: after 4.0.0 before 4.17.0; after 5.0.0 before 5.9.0; 4.0.0; 4.0.0; 4.0.0; 4.0.0; +2 more
Page 2 of 2 · 97 total
12