Skip to content
Craftcms Craft Cms vulnerabilities
-
craftcms cms, craft cms +1 more
Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions
CVE-2026-33162
Fix available
4.9 Medium
-
craftcms cms, craft cms +1 more
Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
CVE-2026-33161
Fix available
1.3 Low
-
craftcms cms, craft cms +1 more
Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL
CVE-2026-33160
Fix available
2.7 Low
-
craftcms cms, craft cms +1 more
Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
CVE-2026-33159
Fix available
6.9 Medium
-
craftcms cms, craft cms +1 more
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
CVE-2026-33158
Fix available
4.9 Medium
-
craftcms cms, craft cms +1 more
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
CVE-2026-33157
Public exploitFix available
8.6 High
-
craftcms cms, craft cms +1 more
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
CVE-2026-33051
Fix available
5.3 Medium
-
craftcms cms, craft cms +1 more
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
CVE-2026-32267
Fix available
7.7 High
-
craftcms cms, craft cms +1 more
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
CVE-2026-32264
Fix available
8.6 High
-
craftcms cms, craft cms +1 more
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
CVE-2026-32263
Fix available
8.6 High
-
craftcms cms, craft cms +1 more
Craft CMS has a Path Traversal Vulnerability in AssetsController
CVE-2026-32262
Fix available
5.3 Medium
-
craftcms cms, craft cms +1 more
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
CVE-2026-31857
Public exploitFix available
8.1 High
-
craftcms cms, craft cms +1 more
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
CVE-2026-31858
Fix available
8.7 High
-
craftcms cms, craft cms +1 more
Craft has Reflective XSS via incomplete return URL sanitization
CVE-2026-31859
Fix available
6.9 Medium
-
craftcms cms, craft cms +1 more
Craft has a potential information disclosure vulnerability in preview tokens
CVE-2026-29113
Fix available
2.3 Low
-
craftcms cms, craft cms +1 more
Craft has an unauthenticated activation email trigger with potential user enumeration
CVE-2026-29069
Fix available
6.9 Medium
-
craftcms cms, craft cms +1 more
Craft is affected by potential authenticated Remote Code Execution via Twig SSTI
CVE-2026-28784
Fix available
8.6 High
-
craftcms cms, craft cms +1 more
Craft has a Permission Bypass and IDOR in Duplicate Entry Action
CVE-2026-28782
Fix available
5.3 Medium
-
craftcms cms, craft cms +1 more
Craft has a Twig Function Blocklist Bypass
CVE-2026-28783
Fix available
9.4 Critical
-
craftcms cms, craft cms +1 more
Craft Affected by Entries Authorship Spoofing via Mass Assignment
CVE-2026-28781
Fix available
7.1 High
-
craftcms cms, craft cms +1 more
Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
CVE-2026-28697
Fix available
9.4 Critical
-
craftcms cms, craft cms +1 more
Craft affected by IDOR via GraphQL @parseRefs
CVE-2026-28696
Fix available
8.7 High
-
craftcms cms, craft cms +1 more
Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
CVE-2026-28695
Public exploitFix available
7.5 High
-
craftcms cms, craft cms +1 more
Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
CVE-2026-27129
Fix available
5.7 Medium
-
craftcms cms, craft cms +1 more
Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit
CVE-2026-27128
Fix available
6.9 Medium
-
craftcms cms, craft cms +1 more
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
CVE-2026-27127
Fix available
7.0 High
-
craftcms cms, craft cms +1 more
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
CVE-2026-27126
Fix available
5.9 Medium
-
craftcms cms, craft cms +1 more
Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
CVE-2026-25498
Fix available
8.6 High
-
craftcms cms, craft cms +1 more
Craft has a GraphQL Asset Mutation Privilege Escalation
CVE-2026-25497
Fix available
8.6 High
-
craftcms cms, craft cms +1 more
Craft has a stored XSS in Number Prefix & Suffix Fields
CVE-2026-25496
Fix available
4.8 Medium
-
craftcms cms, craft cms +1 more
Craft has a SQL Injection in Element Indexes via criteria[orderBy]
CVE-2026-25495
Fix available
8.7 High
-
craftcms cms, craft cms +1 more
Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation
CVE-2026-25494
Fix available
6.9 Medium
-
craftcms cms, craft cms +1 more
Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect
CVE-2026-25493
Fix available
6.9 Medium
-
craftcms cms, craft cms +1 more
Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
CVE-2026-25492
Fix available
5.3 Medium
-
craftcms cms, craft cms +1 more
Craft has a Stored XSS in Entry Types Name
CVE-2026-25491
Fix available
1.9 Low
-
craftcms cms, craft cms +1 more
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
CVE-2025-68455
Fix available
8.6 High
-
craftcms cms, craft cms +1 more
Unauthenticated Craft CMS users can trigger a database backup
CVE-2025-68456
Fix available
7.0 High
-
craftcms cms, craft cms +1 more
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
CVE-2025-68454
Fix available
5.2 Medium
-
craftcms cms, craft cms +1 more
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
CVE-2025-68437
Fix available
5.0 Medium
-
craftcms cms, craft cms +1 more
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
CVE-2025-68436
Fix available
4.9 Medium
-
craftcms cms, craft cms +1 more
Craft Potential Remote Code Execution via Twig SSTI
CVE-2025-57811
Fix available
6.1 Medium
-
craftcms cms, craft cms +1 more
Craft contains a theoretical bypass for CVE-2025-23209
CVE-2025-54417
Fix available
5.2 Medium
-
craft cms, craftcms craft cms +1 more
Craft CMS stores user-provided content in session files
CVE-2025-35939
In KEVFix available
6.9 Medium
-
craftcms cms, craft cms +1 more
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
CVE-2025-46731
Public exploitFix available
7.3 High
-
craft cms cms, craftcms craft cms +1 more
Craft CMS Allows Remote Code Execution
CVE-2025-32432
In KEVPublic exploitFix available
EPSS 99.8%
10.0 Critical
-
craft cms cms, craftcms craft cms +1 more
Potential RCE with a compromised security key in craft/cms
CVE-2025-23209
In KEVFix available
EPSS 21.6%
8.1 High
-
craft cms cms, craftcms craft cms +1 more
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
CVE-2024-56145
In KEVPublic exploitFix available
EPSS 97.5%
9.3 Critical
-
craftcms cms, craft cms +1 more
Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI
CVE-2024-52293
Fix available
7.2 High
-
craftcms cms, craft cms +1 more
Craft Allows Attackers to Read Arbitrary System Files
CVE-2024-52292
Fix available
7.7 High
-
craftcms cms, craft cms +1 more
Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
CVE-2024-52291
Fix available
8.5 High
- Show olderLoading…