Skip to contentStatamic vulnerabilities
Newest
- craftcms cms, craft cms +1 moreCraftCMS has an RCE vulnerability via relational conditionals in the control panelCVE-2026-31857Public exploitFix available8.1 High
- craftcms cms, craft cms +1 moreCraftCMS's `ElementSearchController` Affected by Blind SQL InjectionCVE-2026-31858Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft has Reflective XSS via incomplete return URL sanitizationCVE-2026-31859Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a potential information disclosure vulnerability in preview tokensCVE-2026-29113Fix available2.3 Low
- statamic cms, yifangcms yifang +1 moreYiFang CMS D_singlePageGroup.php update cross site scriptingCVE-2026-37435.1 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS D_singlePage.php update cross site scriptingCVE-2026-37425.1 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS D_friendLink.php update cross site scriptingCVE-2026-37415.1 Medium
- craftcms cms, craft cms +1 moreCraft has an unauthenticated activation email trigger with potential user enumerationCVE-2026-29069Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft is affected by potential authenticated Remote Code Execution via Twig SSTICVE-2026-28784Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a Permission Bypass and IDOR in Duplicate Entry ActionCVE-2026-28782Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft has a Twig Function Blocklist BypassCVE-2026-28783Fix available9.4 Critical
- craftcms cms, craft cms +1 moreCraft Affected by Entries Authorship Spoofing via Mass AssignmentCVE-2026-28781Fix available7.1 High
- craftcms cms, craft cms +1 moreCraft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig TemplatesCVE-2026-28697Fix available9.4 Critical
- craftcms cmsCraft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field OptionsCVE-2026-56393Fix available4.6 Medium
- craftcms cms, craft cms +1 moreCraft affected by IDOR via GraphQL @parseRefsCVE-2026-28696Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadgetCVE-2026-28695Public exploitFix available7.5 High
- max-3000 maxsite cms, maxsite cms +1 moreMaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injectionCVE-2026-3395Public exploit6.9 Medium
- statamic cms, statamic +1 moreStatamic vulnerable to privilege escalation via stored cross-site scriptingCVE-2026-28426Fix available8.7 High
- statamic cms, statamic +1 moreStatamic vulnerable to remote code execution via Antlers-enabled control panel inputsCVE-2026-28425Fix available8.0 High
- statamic cms, statamic +1 moreStatamic's missing authorization allows access to email addressesCVE-2026-28424Fix available6.5 Medium
- statamic cms, statamic +1 moreStatamic Vulnerable to Server-Side Request Forgery via GlideCVE-2026-28423Fix available6.8 Medium
- statamic cms, statamic +1 moreStatamic allows Authenticated Control Panel users to escalate privileges via elevated session bypassCVE-2026-27939Fix available8.8 High
- craftcms cmsCraft CMS - Stored XSS in Table Field via Row Heading Column TypeCVE-2026-56383Fix available4.6 Medium
- statamic cms, statamic +1 moreStatamic is vulnerable to account takeover via password reset link injectionCVE-2026-27593Fix available9.3 Critical
- craftcms cms, craft cms +1 moreCloud Metadata SSRF Protection Bypass via IPv6 ResolutionCVE-2026-27129Fix available5.7 Medium
- craftcms cms, craft cms +1 moreCraft CMS's race condition in Token Service potentially allows for token usage greater than the token limitCVE-2026-27128Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS has Cloud Metadata SSRF Protection Bypass via DNS RebindingCVE-2026-27127Fix available7.0 High
- craftcms cms, craft cms +1 moreCraft CMS has Stored XSS in Table Field via "HTML" Column TypeCVE-2026-27126Fix available5.9 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS Extended Management D_friendLinkGroup.php update cross site scriptingCVE-2026-29344.8 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS Extended Management D_adManage.php update cross site scriptingCVE-2026-29334.8 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS Extended Management D_adPosition.php update cross site scriptingCVE-2026-29324.8 Medium
- statamic cms, statamic +1 moreStatamic affected by privilege escalation via stored Cross-site ScriptingCVE-2026-27196Fix available8.1 High
- statamic cms, statamic +1 moreStatmatic affected by privilege escalation via stored cross-site scriptingCVE-2026-25759Fix available8.7 High
- statamic cms, statamic +1 moreStatamic's missing authorization allows access to assetsCVE-2026-25633Fix available4.3 Medium
- sarman soft software and technology services industry and trade ltd. co. cmsAuthentication Bypass in Sarman Soft's CMSCVE-2025-69678.7 High
- craftcms cms, craft cms +1 moreCraft has a potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-25498Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a GraphQL Asset Mutation Privilege EscalationCVE-2026-25497Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft has a stored XSS in Number Prefix & Suffix FieldsCVE-2026-25496Fix available4.8 Medium
- craftcms cms, craft cms +1 moreCraft has a SQL Injection in Element Indexes via criteria[orderBy]CVE-2026-25495Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via Alternative IP NotationCVE-2026-25494Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a SSRF in GraphQL Asset Mutation via HTTP RedirectCVE-2026-25493Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying hostCVE-2026-25492Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft has a Stored XSS in Entry Types NameCVE-2026-25491Fix available1.9 Low
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2025-68455Fix available8.6 High
- craftcms cms, craft cms +1 moreUnauthenticated Craft CMS users can trigger a database backupCVE-2025-68456Fix available7.0 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTICVE-2025-68454Fix available5.2 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload MutationCVE-2025-68437Fix available5.0 Medium
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to potential information disclosure via unchecked asset relocationCVE-2025-68436Fix available4.9 Medium
- statamic cmsStatmatic vulnerable to Stored Cross-Site ScriptingCVE-2025-64112Fix available8.0 High
- max-3000 maxsite cms, maxsite cms +1 moreMaxSite CMS save-file-ajax.php unrestricted uploadCVE-2025-123475.3 Medium
- Show moreLoading…