Skip to contentCraftcms Cms vulnerabilities
- craftcms cms, craft cms +1 moreCraft CMS's race condition in Token Service potentially allows for token usage greater than the token limitCVE-2026-27128Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS has Cloud Metadata SSRF Protection Bypass via DNS RebindingCVE-2026-27127Fix available7.0 High
- craftcms cms, craft cms +1 moreCraft CMS has Stored XSS in Table Field via "HTML" Column TypeCVE-2026-27126Fix available5.9 Medium
- craftcms cms, craft cms +1 moreCraft has a potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-25498Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a GraphQL Asset Mutation Privilege EscalationCVE-2026-25497Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a stored XSS in Number Prefix & Suffix FieldsCVE-2026-25496Fix available4.8 Medium
- craftcms cms, craft cms +1 moreCraft has a SQL Injection in Element Indexes via criteria[orderBy]CVE-2026-25495Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via Alternative IP NotationCVE-2026-25494Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via HTTP RedirectCVE-2026-25493Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying hostCVE-2026-25492Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft has a Stored XSS in Entry Types NameCVE-2026-25491Fix available1.9 Low
- craftcmsCraftCMS 3 vCard Plugin 1.0.0 - Remote Code ExecutionCVE-2020-370719.3 Critical
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2025-68455Fix available8.6 High
- craftcms cms, craft cms +1 moreUnauthenticated Craft CMS users can trigger a database backupCVE-2025-68456Fix available7.0 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTICVE-2025-68454Fix available5.2 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload MutationCVE-2025-68437Fix available5.0 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential information disclosure via unchecked asset relocationCVE-2025-68436Fix available4.9 Medium
- craftcms cms, craft cms +1 moreCraft Potential Remote Code Execution via Twig SSTICVE-2025-57811Fix available6.1 Medium
- craftcms cms, craft cms +1 moreCraft contains a theoretical bypass for CVE-2025-23209CVE-2025-54417Fix available5.2 Medium
- craft cms, craftcms craft cms +1 moreCraft CMS stores user-provided content in session filesCVE-2025-35939In KEVFix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTICVE-2025-46731Public exploitFix available7.3 High
- craft cms cms, craftcms craft cms +1 moreCraft CMS Allows Remote Code ExecutionCVE-2025-32432In KEVPublic exploitFix availableEPSS 99.8%10.0 Critical
- craft cms cms, craftcms craft cms +1 morePotential RCE with a compromised security key in craft/cmsCVE-2025-23209In KEVFix availableEPSS 21.6%8.1 High
- craft cms cms, craftcms craft cms +1 moreRCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmsCVE-2024-56145In KEVPublic exploitFix availableEPSS 97.5%9.3 Critical
- craftcms cms, craft cms +1 moreCraft has a Potential Remote Code Execution via missing path normalization & Twig SSTICVE-2024-52293Fix available7.2 High
- craftcms cms, craft cms +1 moreCraft Allows Attackers to Read Arbitrary System FilesCVE-2024-52292Fix available7.7 High
- craftcms cms, craft cms +1 moreCraft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code ExecutionCVE-2024-52291Fix available8.5 High
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in breadcrumb list and title fieldsCVE-2024-45406Fix available5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS Allows TOTP Token To Stay Valid After UseCVE-2024-41800Fix available4.8 Medium
- craftcms craft cmsCraft CMS SQL injection vulnerability via the GraphQL API endpointCVE-2024-37843Public exploitEPSS 53.2%9.8 Critical
- craftcms craft cmsCraft CMS Feed-MeCVE-2023-36260Fix availableDisputed7.5 High
- craftcms craft cmsCraft CMS Audit Plugin Cross Site Scripting vulnerabilityCVE-2023-36259Fix available5.4 Medium
- craftcms cms, craft cms +1 moreCraft CMS Privilege EscalationCVE-2024-21622Fix available5.4 Medium
- craftcms cms, craft cms +1 moreCraft CMS Remote Code Execution vulnerabilityCVE-2023-41892Public exploitFix availableEPSS 94.2%10.0 Critical
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to Remote Code Execution via validatePath bypassCVE-2023-40035Fix available7.2 High
- craftcms craft cmsCraft CMS vulnerable to HTML injectionCVE-2023-334956.1 Medium
- craftcms craft cmsWithdrawn Advisory: CraftCMS Server-Side Template Injection vulnerabilityCVE-2023-30179Disputed7.2 High
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in indexedVolumesCVE-2023-33197Fix available5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS stored XSS in review volumeCVE-2023-33196Fix available5.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS XSS in RSS widget feedCVE-2023-33195Fix available5.0 Medium
- craftcms cms, craft cms, craftercms +2 moreCraftCMS stored XSS in Quick Post widget error messageCVE-2023-33194Fix available3.7 Low
- craftcms craft cmsStored cross site scripting in Craft CMSCVE-2023-2817Fix available5.4 Medium
- craftcms cms, craft cms +1 moreRemote Code Execution via unrestricted file extension in Craft CMSCVE-2023-32679Fix available7.2 High
- craftcms craft cmsCraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameterCVE-2023-301308.8 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to cross site scripting in RSS feed widgetCVE-2023-31144Fix available6.1 Medium
- craftcms craft cmsCross Site Scripting in CraftCMSCVE-2023-30177Fix available6.1 Medium
- craftcms cms, craft cms +1 moreCraft CMS stored cross-site scripting vulnerabilityCVE-2023-23927Fix available6.1 Medium
- craftcms craft cmsCraft CMS discloses password hashesCVE-2022-37783Fix available7.5 High
- craftcms craft cmsCraft CMS Cross-site Scripting vulnerabilityCVE-2022-37246Fix available5.4 Medium
- craftcms craft cmsCraft CMS vulnerable to Cross-site Scripting via entry revisions and draftsCVE-2022-37251Fix available5.4 Medium
- Show moreLoading…