Skip to content
Statamic vulnerabilities
Newest
-
craftcms cms
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
CVE-2026-115938
Fix available
8.7 High
-
craftcms cms
Control panel only API response emulation replaces "securityKey" and reaches server RCE
CVE-2026-115935
Fix available
8.7 High
-
lavalite cms
LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
CVE-2026-113358
8.7 High
-
craftcms cms
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
CVE-2026-112777
8.7 High
-
craftcms cms
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
CVE-2026-112776
9.3 Critical
-
craftcms cms
Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
CVE-2026-112775
8.7 High
-
craftcms cms
Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
CVE-2026-112774
8.7 High
-
craftcms cms
Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
CVE-2026-112773
8.7 High
-
craftcms cms
Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
CVE-2026-112772
8.7 High
-
craftcms cms
Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
CVE-2026-112771
7.1 High
-
craftcms cms
Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
CVE-2026-112770
8.7 High
-
light0011 cms
light0011 cms Vote VoteController.class.php logic error
CVE-2026-112028
6.9 Medium
-
light0011 cms
light0011 cms Uploadify check-exists.php file_exists file information disclosure
CVE-2026-112027
6.9 Medium
-
light0011 cms
light0011 cms UserModel.class.php sha1 weak password hash
CVE-2026-112026
6.3 Medium
-
light0011 cms
light0011 cms Captcha Validation UserController.class.php access control
CVE-2026-112025
6.9 Medium
-
craftcms cms
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
CVE-2026-109308
8.7 High
-
craftcms cms
Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
CVE-2026-109307
2.1 Low
-
craftcms cms
Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
CVE-2026-109306
6.0 Medium
-
craftcms cms
Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
CVE-2026-109305
8.7 High
-
craftcms cms
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
CVE-2026-109304
6.9 Medium
-
exponent cms
Exponent CMS XML-RPC xmlrpc.php userLogin sql injection
CVE-2026-108900
6.9 Medium
-
lavalite cms
LavaLite CMS through 10.1.2 Authorization Bypass via User Update API
CVE-2026-108951
7.1 High
-
craftcms cms
Authenticated RCE via render-components Entry Type overrides
CVE-2026-105985
8.7 High
-
craftcms cms
Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
CVE-2026-92594
8.7 High
-
craftcms cms
Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution
CVE-2026-92593
8.7 High
-
craftcms cms
Craft CMS before 4.18.6 Remote Code Execution via signed cookie
CVE-2026-92592
Public exploit
8.7 High
-
craftcms cms
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
CVE-2026-92591
8.2 High
-
craftcms cms
Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
CVE-2026-92590
5.1 Medium
-
craftcms cms
Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
CVE-2026-92589
5.3 Medium
-
statamic cms
Yot CMS Admin Console admin.php eval code injection
CVE-2026-90709
5.1 Medium
-
statamic cms
Yot CMS Cookie global.php login sql injection
CVE-2026-90708
6.9 Medium
-
craftcms cms
Low-privilege RCE through element-search eager loading
CVE-2026-79987
Public exploit
8.7 High
-
craftcms cms
Craft CMS before 5.10.12 Remote Code Execution via element-index
CVE-2026-86732
8.7 High
-
craftcms cms
Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController
CVE-2026-86731
7.1 High
-
craftcms cms
Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
CVE-2026-86730
8.7 High
-
light0011 cms
light0011 cms Debug Mode config.php information disclosure
CVE-2026-86308
6.9 Medium
-
light0011 cms
light0011 cms cross-site request forgery
CVE-2026-86307
5.3 Medium
-
light0011 cms
light0011 cms Cookie Helper UserModel.class.php improper authentication
CVE-2026-86306
6.9 Medium
-
light0011 cms
light0011 cms Upload.class.php upload unrestricted upload
CVE-2026-86305
6.9 Medium
-
light0011 cms
light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting
CVE-2026-85382
5.3 Medium
-
light0011 cms
light0011 cms Chapter Controller ChapterController.class.php authorization
CVE-2026-85381
6.9 Medium
-
light0011 cms
light0011 cms UEditor controller.php catchimage server-side request forgery
CVE-2026-85380
6.9 Medium
-
light0011 cms
light0011 cms Query Builder ChapterController.class.php searchChapter sql injection
CVE-2026-85379
6.9 Medium
-
light0011 cms
light0011 cms Chapter Controller ChapterController.class.php _initialize authorization
CVE-2026-85378
6.9 Medium
-
craftcms cms
Authenticated SQL Injection via nested eager-loading criteria
CVE-2026-79991
7.1 High
-
craftcms cms
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
CVE-2026-84802
5.3 Medium
-
craftcms cms
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
CVE-2026-84801
8.7 High
-
craftcms cms
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
CVE-2026-84800
7.1 High
-
craftcms cms
Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations
CVE-2026-84799
5.3 Medium
-
craftcms cms
Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
CVE-2026-84798
7.1 High
- Show olderLoading…