Login Request a demo
FO
Product
formwork
by getformwork · last CVE Oct 6, 2026
5
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 0High 2Medium 2Low 1
Severity
All severities5Critical0High2Medium2Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add formwork to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-27198
8.8
0%
Feb 21
Formwork Improperly Manages Privileges During User Creation
Affected: >= 2.0.0, < 2.3.4
CVE-2026-104478
7.1
0%
Oct 2
Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
Affected: before 2.3.13
CVE-2026-82451
6.1
0%
Aug 29
Formwork < 2.3.11 Stored XSS via Referer Header
Affected: 2.0.0 through 2.3.10
CVE-2025-65956
5.4
0%
Nov 25
Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags
Affected: < 2.2.0
CVE-2026-105950
3.5
0%
Oct 6
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; +7 more
Showing 5