Login Request a demo
MT
Product
Movable Type
by Six Apart Ltd. · last CVE Oct 7, 2026
7
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 3High 1Medium 1Low 0
Severity
All severities7Critical3High1Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Movable Type to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-25776
9.8
1%
Apr 8
Movable Type provided by Six Apart Ltd
Affected: 9.1.0 and earlier; 9.0.6 and earlier; 8.8.2 and earlier; 8.0.9 and earlier; 5.1 to 5.18; 5.2; +6 more
CVE-2026-33088
9.8
0%
Apr 8
Movable Type provided by Six Apart Ltd
Affected: 9.1.0 and earlier; 9.0.6 and earlier; 8.8.2 and earlier; 8.0.9 and earlier; 5.1 to 5.18; 5.2; +6 more
CVE-2026-96408
9.4
0%
Oct 7
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the…
Affected: 9.0.0 through 9.0.9; 8.8.0 through 8.8.5; 8.0.0 through 8.0.12
CVE-2026-103668
8.6
0%
Oct 7
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected…
Affected: 9.0.0 through 9.0.9; 8.8.0 through 8.8.5; 8.0.0 through 8.0.12
CVE-2026-44392
4.3
0%
May 20
Missing authorization vulnerability exists in Movable Type
Affected: 9.1.1 and earlier; 9.0.7 and earlier; 8.8.3 and earlier; 8.0.10 and earlier
CVE-2009-2492
–
1%
Jul 17
Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified…
Affected: 3.33
CVE-2007-0604
–
1%
Jan 30
Cross-site scripting (XSS) vulnerability in Movable Type (MT) before 3.34 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the…
Affected: through 3.33
Showing 7