Skip to contentCraftcms Cms vulnerabilities
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox EscapeCVE-2026-72781Public exploitFix available8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configCVE-2026-72778Public exploitFix available8.7 High
- craftcms cmsCraft CMS: Unauthorized Deletion of Destination Folders During Forced MovesCVE-2026-50282Fix available4.9 Medium
- craftcms cmsCraft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsCVE-2026-50281Fix available7.1 High
- craftcms cmsCraft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save checkCVE-2026-50280Fix available6.0 Medium
- craftcms cmsCraft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapCVE-2026-50279Fix available7.6 High
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via referrer redirectCVE-2026-55794Public exploitFix available8.7 High
- craftcms cmsCraft CMS: Sensitive File Disclosure / Server-Side File ReadCVE-2026-55792Fix available6.0 Medium
- craftcms cmsCraft CMS: DOM XSS via GitHub issue title in CraftSupport widgetCVE-2026-55790Fix available7.4 High
- craftcms cmsCraft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsCVE-2026-50284Fix available7.1 High
- craftcms cmsCraft CMS: Unauthorized Deletion of Source Assets During File ReplacementCVE-2026-50283Fix available5.3 Medium
- craftcms cmsCraft CMS: Stored XSS via Structure entry title in table viewCVE-2026-55793Fix available5.9 Medium
- craftcms cmsCraft CMS - Authenticated Path Traversal in assets/icon Extension ParameterCVE-2026-56394Fix available7.1 High
- craftcms cmsCraft CMS - Missing Authorization in assets/preview-thumb EndpointCVE-2026-56384Fix available5.3 Medium
- craftcms cmsCraft CMS - Remote Code Execution via Missing Config Sanitization in FieldsControllerCVE-2026-56382Fix available8.6 High
- craftcms cmsCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsCVE-2026-55791Fix available6.9 Medium
- craftcms cmsCraft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information DisclosureCVE-2026-44012Fix available7.1 High
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-44011Public exploitFix available8.6 High
- craftcms cmsCraft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII DisclosureCVE-2026-44010Fix available7.1 High
- craftcms cmsCraft CMS has a host header injection leading to SSRF via resource-js endpointCVE-2026-41130Fix available5.5 Medium
- craftcms cmsCraft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads MutationsCVE-2026-41129Fix available5.5 Medium
- craftcms cmsCraft CMS has a Missing Authorization Check on User Group Removal via save-permissions ActionCVE-2026-41128Fix available5.3 Medium
- craftcms cmsCraft CMS - Authorization Bypass in assets/preview-file EndpointCVE-2026-56385Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissionsCVE-2026-33162Fix available4.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized usersCVE-2026-33161Fix available1.3 Low
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URLCVE-2026-33160Fix available2.7 Low
- craftcms cms, craft cms +1 moreCraft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted usersCVE-2026-33159Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)CVE-2026-33158Fix available4.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-33157Public exploitFix available8.6 High
- craftcms cms, craft cms +1 moreCraft CMS Vulnerable to Stored XSS in Revision Context MenuCVE-2026-33051Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()CVE-2026-32267Fix available7.7 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllerCVE-2026-32264Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE via EntryTypesControllerCVE-2026-32263Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft CMS has a Path Traversal Vulnerability in AssetsControllerCVE-2026-32262Fix available5.3 Medium
- craftcms cmsCraft CMS - Stored XSS via User Group Name in User Permissions PageCVE-2026-56381Fix available4.6 Medium
- craftcms cms, craft cms +1 moreCraftCMS has an RCE vulnerability via relational conditionals in the control panelCVE-2026-31857Public exploitFix available8.1 High
- craftcms cms, craft cms +1 moreCraftCMS's `ElementSearchController` Affected by Blind SQL InjectionCVE-2026-31858Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft has Reflective XSS via incomplete return URL sanitizationCVE-2026-31859Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a potential information disclosure vulnerability in preview tokensCVE-2026-29113Fix available2.3 Low
- craftcms cms, craft cms +1 moreCraft has an unauthenticated activation email trigger with potential user enumerationCVE-2026-29069Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft is affected by potential authenticated Remote Code Execution via Twig SSTICVE-2026-28784Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a Permission Bypass and IDOR in Duplicate Entry ActionCVE-2026-28782Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft has a Twig Function Blocklist BypassCVE-2026-28783Fix available9.4 Critical
- craftcms cms, craft cms +1 moreCraft Affected by Entries Authorship Spoofing via Mass AssignmentCVE-2026-28781Fix available7.1 High
- craftcms cms, craft cms +1 moreCraft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig TemplatesCVE-2026-28697Fix available9.4 Critical
- craftcms cmsCraft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field OptionsCVE-2026-56393Fix available4.6 Medium
- craftcms cms, craft cms +1 moreCraft affected by IDOR via GraphQL @parseRefsCVE-2026-28696Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetCVE-2026-28695Public exploitFix available7.5 High
- craftcms cmsCraft CMS - Stored XSS in Table Field via Row Heading Column TypeCVE-2026-56383Fix available4.6 Medium
- craftcms cms, craft cms +1 moreCloud Metadata SSRF Protection Bypass via IPv6 ResolutionCVE-2026-27129Fix available5.7 Medium
- Show moreLoading…