Login Request a demo
WI
Product
winter
by wintercms · last CVE Aug 26, 2026
18
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 2High 6Medium 9Low 1
Severity
All severities18Critical2High6Medium9Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add winter to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-32639
6.8
0%
Aug 26
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Affected: < 1.2.13
CVE-2026-32593
5.9
0%
Aug 26
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Affected: < 1.2.13
CVE-2026-54256
5.4
0%
Aug 26
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Affected: < 1.2.13
CVE-2023-52085
5.4
30%
Dec 29
Winter is a free, open-source content management system
Affected: before 1.2.4
CVE-2023-52084
5.4
0%
Dec 28
Winter is a free, open-source content management system
Affected: before 1.2.4
CVE-2026-63179
4.9
1%
Aug 26
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Affected: < 1.2.13
CVE-2026-79773
4.9
0%
Aug 25
Winter CMS before 1.2.13 Local File Inclusion via JavaScript
Affected: before 1.2.13
CVE-2023-52083
4.8
0%
Dec 28
Winter is a free, open-source content management system
Affected: before 1.2.4
CVE-2023-37269
4.8
3%
Jul 7
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework
Affected: before 1.2.3
Showing 9