WI
Product
winter
18
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 2High 6Medium 9Low 1
Watch
Add winter to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27591 | 9.9 | Mar 11 | Winter: Privilege escalation by authenticated backend users Affected: >= 1.2.0, < 1.2.12; >= 1.1.0, < 1.1.12; < 1.0.477 |
| CVE-2022-39357 | 9.8 | Oct 26 | Winter vulnerable to Prototype Pollution in Snowboard framework Affected: >= 1.1.8, < 1.1.10; = 1.2.0 |
| CVE-2026-79774 | 8.4 | Aug 25 | Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy Affected: 1.2.7 before 1.2.13 |
| CVE-2024-54149 | 8.4 | Dec 9 | Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion Affected: >= 1.2.0, < 1.2.7; >= 1.1.0, < 1.1.11; < 1.0.476 |
| CVE-2026-32258 | 8.1 | Aug 26 | Winter: Stored XSS through Editor Settings custom styles Affected: >= 1.2.10, < 1.2.13 |
| CVE-2026-32257 | 8.1 | Aug 26 | Winter: Stored XSS through Brand Settings custom styles Affected: < 1.2.13 |
| CVE-2024-29686 | 7.2 | Mar 29 | Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and… Affected: 1.2.3 |
| CVE-2026-35445 | 7.1 | Aug 26 | Winter: Authenticated backend users can bypass Users controller permission checks Affected: < 1.2.13 |
| CVE-2026-32639 | 6.8 | Aug 26 | Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads Affected: < 1.2.13 |
| CVE-2026-32593 | 5.9 | Aug 26 | Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax Affected: < 1.2.13 |
| CVE-2026-54256 | 5.4 | Aug 26 | Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata Affected: < 1.2.13 |
| CVE-2023-52085 | 5.4 | Dec 29 | Winter is a free, open-source content management system Affected: before 1.2.4 |
| CVE-2023-52084 | 5.4 | Dec 28 | Winter is a free, open-source content management system Affected: before 1.2.4 |
| CVE-2026-63179 | 4.9 | Aug 26 | Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets Affected: < 1.2.13 |
| CVE-2026-79773 | 4.9 | Aug 25 | Winter CMS before 1.2.13 Local File Inclusion via JavaScript Affected: before 1.2.13 |
| CVE-2023-52083 | 4.8 | Dec 28 | Winter is a free, open-source content management system Affected: before 1.2.4 |
| CVE-2023-37269 | 4.8 | Jul 7 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework Affected: before 1.2.3 |
| CVE-2026-22254 | 3.5 | Feb 6 | Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager Affected: < 1.2.10 |
Showing 18