WI
Product
winter
18
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 2High 6Medium 9Low 1
Watch
Add winter to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-79774 | 8.4 | Aug 25 | Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy Affected: 1.2.7 before 1.2.13 |
| CVE-2024-54149 | 8.4 | Dec 9 | Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion Affected: >= 1.2.0, < 1.2.7; >= 1.1.0, < 1.1.11; < 1.0.476 |
| CVE-2026-32258 | 8.1 | Aug 26 | Winter: Stored XSS through Editor Settings custom styles Affected: >= 1.2.10, < 1.2.13 |
| CVE-2026-32257 | 8.1 | Aug 26 | Winter: Stored XSS through Brand Settings custom styles Affected: < 1.2.13 |
| CVE-2024-29686 | 7.2 | Mar 29 | Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and… Affected: 1.2.3 |
| CVE-2026-35445 | 7.1 | Aug 26 | Winter: Authenticated backend users can bypass Users controller permission checks Affected: < 1.2.13 |
Showing 6