OC
Product
october
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 15Medium 36Low 4
Watch
Add october to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-49400 | 3.3 | Sep 14 | October CMS: PHP Object Injection via Backend Widget Session Storage Affected: < 3.7.17; >= 4.0.0, < 4.2.23 |
| CVE-2026-29179 | 3.3 | Apr 21 | October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations Affected: >= 4.0.0, < 4.1.16; < 3.7.16 |
| CVE-2026-27937 | 3.1 | Apr 21 | October: Reflected XSS via DataTable Form Widget Affected: >= 4.0.0, < 4.1.16; < 3.7.16 |
| CVE-2020-5297 | 2.7 | Jun 3 | Upload whitelisted files to any directory in OctoberCMS Affected: >= 1.0.319, < 1.0.466 |
Showing 4