Login Request a demo
PI
Product
pimcore
by pimcore · last CVE Oct 12, 2026
145
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Vulnerabilities145In the news0Timeline
Severity mix
Critical 6High 45Medium 90Low 0
Severity
All severities145Critical6High45Medium90Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add pimcore to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55634
9.9
1%
Aug 28
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
Affected: < 11.5.19; >= 12.0.0-RC1, < 12.3.10; >= 2026.1.0, < 2026.1.6
CVE-2022-39365
9.8
2%
Oct 27
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
Affected: < 10.5.9
CVE-2019-18985
9.8
1%
Nov 15
Pimcore before 6.2.2 lacks brute force protection for the 2FA token
Affected: before 6.2.2
CVE-2019-18981
9.8
1%
Nov 15
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification
Affected: before 6.2.2
CVE-2026-55220
9.3
1%
Aug 28
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
Affected: < 11.5.19; >= 12.0.0-RC1, < 12.3.10; >= 2026.1.0, < 2026.1.6
CVE-2021-4139
9.0
1%
Dec 21
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected: before 10.2.7
Showing 6