Skip to contentCraftcms vulnerabilities
Newest
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Inventory Location NameCVE-2026-29176Fix available4.8 Medium
- craftcms commerce, craft commerce +1 moreMultiple Stored XSS in Commerce Inventory Page Leading to Session HijackingCVE-2026-29175Fix available8.6 High
- craftcms commerce, craft commerce +1 moreCraft Commerce has a SQL Injection in Commerce Inventory Table SortingCVE-2026-29174Fix available8.7 High
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS while updating Order Status from Orders TableCVE-2026-29173Fix available1.9 Low
- craftcms commerce, craft commerce +1 moreCraft Commerce has a SQL Injection in Commerce Purchasables Table SortingCVE-2026-29172Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft has a potential information disclosure vulnerability in preview tokensCVE-2026-29113Fix available2.3 Low
- craftcms cms, craft cms +1 moreCraft has an unauthenticated activation email trigger with potential user enumerationCVE-2026-29069Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft is affected by potential authenticated Remote Code Execution via Twig SSTICVE-2026-28784Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a Permission Bypass and IDOR in Duplicate Entry ActionCVE-2026-28782Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft has a Twig Function Blocklist BypassCVE-2026-28783Fix available9.4 Critical
- craftcms cms, craft cms +1 moreCraft Affected by Entries Authorship Spoofing via Mass AssignmentCVE-2026-28781Fix available7.1 High
- craftcms cms, craft cms +1 moreCraft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig TemplatesCVE-2026-28697Fix available9.4 Critical
- craftcms cmsCraft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field OptionsCVE-2026-56393Fix available4.6 Medium
- craftcms cms, craft cms +1 moreCraft affected by IDOR via GraphQL @parseRefsCVE-2026-28696Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetCVE-2026-28695Public exploitFix available7.5 High
- craftcms cmsCraft CMS - Stored XSS in Table Field via Row Heading Column TypeCVE-2026-56383Fix available4.6 Medium
- craftcms cms, craft cms +1 moreCloud Metadata SSRF Protection Bypass via IPv6 ResolutionCVE-2026-27129Fix available5.7 Medium
- craftcms cms, craft cms +1 moreCraft CMS's race condition in Token Service potentially allows for token usage greater than the token limitCVE-2026-27128Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS has Cloud Metadata SSRF Protection Bypass via DNS RebindingCVE-2026-27127Fix available7.0 High
- craftcms cms, craft cms +1 moreCraft CMS has Stored XSS in Table Field via "HTML" Column TypeCVE-2026-27126Fix available5.9 Medium
- craftcms cms, craft cms +1 moreCraft has a potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-25498Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a GraphQL Asset Mutation Privilege EscalationCVE-2026-25497Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a stored XSS in Number Prefix & Suffix FieldsCVE-2026-25496Fix available4.8 Medium
- craftcms cms, craft cms +1 moreCraft has a SQL Injection in Element Indexes via criteria[orderBy]CVE-2026-25495Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via Alternative IP NotationCVE-2026-25494Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via HTTP RedirectCVE-2026-25493Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying hostCVE-2026-25492Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft has a Stored XSS in Entry Types NameCVE-2026-25491Fix available1.9 Low
- craftcmsCraftCMS 3 vCard Plugin 1.0.0 - Remote Code ExecutionCVE-2020-370719.3 Critical
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege EscalationCVE-2026-25522Fix available6.1 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege EscalationCVE-2026-25490Fix available6.1 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege EscalationCVE-2026-25489Fix available6.1 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationCVE-2026-25488Fix available6.1 Medium
- craftcms commerce, craft commerce +1 moreCraft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege EscalationCVE-2026-25487Fix available6.1 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege EscalationCVE-2026-25486Fix available6.1 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege EscalationCVE-2026-25485Fix available6.2 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS in Product Type NameCVE-2026-25484Fix available4.8 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored XSS via Order Status Message with potential database exfiltrationCVE-2026-25483Fix available6.2 Medium
- craftcms commerce, craft commerce +1 moreCraft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)CVE-2026-25482Fix available6.2 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2025-68455Fix available8.6 High
- craftcms cms, craft cms +1 moreUnauthenticated Craft CMS users can trigger a database backupCVE-2025-68456Fix available7.0 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTICVE-2025-68454Fix available5.2 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload MutationCVE-2025-68437Fix available5.0 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential information disclosure via unchecked asset relocationCVE-2025-68436Fix available4.9 Medium
- craftcms cms, craft cms +1 moreCraft Potential Remote Code Execution via Twig SSTICVE-2025-57811Fix available6.1 Medium
- craftcms cms, craft cms +1 moreCraft contains a theoretical bypass for CVE-2025-23209CVE-2025-54417Fix available5.2 Medium
- craft cms, craftcms craft cms +1 moreCraft CMS stores user-provided content in session filesCVE-2025-35939In KEVFix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTICVE-2025-46731Public exploitFix available7.3 High
- craft cms cms, craftcms craft cms +1 moreCraft CMS Allows Remote Code ExecutionCVE-2025-32432In KEVPublic exploitFix availableEPSS 99.8%10.0 Critical
- craft cms cms, craftcms craft cms +1 morePotential RCE with a compromised security key in craft/cmsCVE-2025-23209In KEVFix availableEPSS 21.6%8.1 High
- Show moreLoading…