OC
Product
october
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 15Medium 36Low 4
Watch
Add october to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-22692 | 6.8 | Apr 14 | October CMS: Twig Sandbox Bypass via Collection Methods Affected: < 3.7.13; >= 4.0.0, < 4.1.5 |
| CVE-2020-26231 | 6.7 | Nov 23 | Bypass of fix for CVE-2020-15247, Twig sandbox escape Affected: = 1.0.469 |
| CVE-2026-26274 | 6.6 | Apr 21 | October: Safe Mode Bypass via Twig Database Write Operations Affected: >= 4.0.0, < 4.1.10; < 3.7.14 |
| CVE-2020-15128 | 6.3 | Jul 31 | Reliance on Cookies without validation in OctoberCMS Affected: < 1.0.468 |
| CVE-2018-7198 | 6.1 | Feb 18 | October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page Affected: through 1.0.431 |
| CVE-2017-1000193 | 6.1 | Nov 17 | October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser Affected: through 1.0.412 |
| CVE-2026-24907 | 5.4 | Apr 14 | October CMS has Stored XSS via Event Log Mail Preview Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |
| CVE-2026-24906 | 5.4 | Apr 14 | October CMS has Stored XSS in its Backend Editor Markup Classes Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |
| CVE-2024-25837 | 5.4 | Aug 16 | A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload… Affected: through 1.3.8 |
| CVE-2024-25637 | 5.4 | Jun 26 | Reflected XSS via X-October-Request-Handler Header Affected: >= 3.2, < 3.5.15 |
| CVE-2023-44383 | 5.4 | Nov 29 | October CMS stored XSS by authenticated backend user with improper configuration Affected: >= 3.0.0, 3.5.2 |
| CVE-2023-43876 | 5.4 | Sep 28 | A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost… Affected: 3.4.16 |
| CVE-2023-37692 | 5.4 | Jul 26 | An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file Affected: 3.4.4 |
| CVE-2020-15249 | 5.4 | Nov 23 | Stored XSS by authenticated backend user with access to upload files Affected: >= 1.0.319, < 1.0.469 |
| CVE-2020-4061 | 5.4 | Jul 2 | Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites Affected: 1.0.319 before 1.0.467 |
| CVE-2018-1999008 | 5.4 | Jul 23 | October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated… Affected: before 1.0.437 |
| CVE-2017-15284 | 5.4 | Oct 12 | Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile Affected: 1.0.425 |
| CVE-2015-5613 | 5.4 | Sep 28 | Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving a file title, a… Affected: All versions, or not specified |
| CVE-2022-23655 | 5.3 | Feb 23 | Missing server signature validation in OctoberCMS Affected: >= 1.1.0, < 1.1.11; < 1.0.475 |
| CVE-2021-21264 | 5.2 | May 3 | Bypass of fix for CVE-2020-26231, Twig sandbox escape Affected: 1.0.471; 1.1.1 |
| CVE-2020-15247 | 5.2 | Nov 23 | Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. Affected: >= 1.0.319, < 1.0.469 |
| CVE-2020-5299 | 5.1 | Jun 3 | Potential CSV Injection vector in OctoberCMS Affected: >= 1.0.319, < 1.0.466 |
| CVE-2026-26067 | 4.9 | Apr 21 | October: Safe Mode Bypass via CSS Preprocessor Compilers Affected: >= 4.0.0, < 4.1.10; < 3.7.14 |
| CVE-2026-25125 | 4.9 | Apr 14 | October CMS: Environment Variable Exfiltration via INI Parser Interpolation Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |
| CVE-2024-51991 | 4.9 | May 5 | October CMS Allows Unprotected SVG Rename in Media Manager Affected: < 3.7.5 |
| CVE-2023-44381 | 4.9 | Dec 1 | October CMS safe mode bypass using Page template injection Affected: >= 3.0.0, < 3.4.15 |
| CVE-2020-5296 | 4.9 | Jun 3 | Arbitrary File Deletion vulnerability in OctoberCMS Affected: >= 1.0.319, < 1.0.466 |
| CVE-2020-5295 | 4.9 | Jun 3 | Local File read vulnerability in OctoberCMS Affected: >= 1.0.319, < 1.0.466 |
| CVE-2026-25133 | 4.8 | Apr 14 | October CMS has Stored XSS via SVG Filter Bypass Affected: < 3.7.14; >= 4.0.0, < 4.1.10 |
| CVE-2025-61674 | 4.8 | Jan 10 | October CMS Vulnerable to Stored XSS via Editor and Branding Styles Affected: >= 4.0.0, < 4.0.12; < 3.7.13 |
| CVE-2025-61676 | 4.8 | Jan 10 | October CMS Vulnerable to Stored XSS via Branding Styles Affected: >= 4.0.0, < 4.0.12; < 3.7.13 |
| CVE-2024-24764 | 4.8 | Jun 26 | October Open Redirect for Administrator Accounts Affected: >= 3.2, < 3.5.15 |
| CVE-2020-11083 | 4.8 | Jul 14 | Stored XSS in October Affected: 1.0.319 before 1.0.466 |
| CVE-2020-5298 | 4.8 | Jun 3 | Reflected XSS when importing CSV in OctoberCMS Affected: >= 1.0.319, < 1.0.466 |
| CVE-2024-45962 | 4.7 | Oct 2 | October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system Affected: 3.6.30 |
| CVE-2020-15248 | 4.2 | Nov 23 | Privilege escalation by backend users assigned to the default "Publisher" system role Affected: >= 1.0.319, < 1.0.470 |
Showing 36