Skip to contentStatamic vulnerabilities
Newest
- craftcms cmsCraft CMS - Missing Authorization in assets/preview-thumb EndpointCVE-2026-56384Fix available5.3 Medium
- craftcms cmsCraft CMS - Remote Code Execution via Missing Config Sanitization in FieldsControllerCVE-2026-56382Fix available8.6 High
- craftcms cmsCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsCVE-2026-55791Fix available6.9 Medium
- statamic cmsStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesCVE-2026-49288Fix available4.3 Medium
- statamic cmsStatamic CMS vulnerable to unsafe method invocation via collection sorting allows data destructionCVE-2026-49287Fix available7.4 High
- bolt cmsBolt CMS HTML Attribute TextType.php HTML injectionCVE-2026-115115.1 Medium
- statamic cmsStatamic: Server-Side Request Forgery via GlideCVE-2026-45660Fix available5.4 Medium
- statamic cmsStatamic: Email enumeration via forgot password endpointCVE-2026-44306Fix available5.3 Medium
- craftcms cmsCraft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information DisclosureCVE-2026-44012Fix available7.1 High
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-44011Public exploitFix available8.6 High
- craftcms cmsCraft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII DisclosureCVE-2026-44010Fix available7.1 High
- bootstrap cmsBootstrap CMS Page Creation show.blade.php code injectionCVE-2026-75085.3 Medium
- grav cmsGrav CMS Cache Value FileCache.php doGet deserializationCVE-2026-7317Fix available2.3 Low
- maxsite cmsMaxSite CMS ushki Plugin cross site scriptingCVE-2026-70164.8 Medium
- maxsite cmsMaxSite CMS Guestbook Plugin cross site scriptingCVE-2026-70154.8 Medium
- maxsite cmsMaxSite CMS down_count Plugin cross site scriptingCVE-2026-70144.8 Medium
- maxsite cmsMaxSite CMS mail_send Plugin cross site scriptingCVE-2026-70134.8 Medium
- maxsite cmsMaxSite CMS Redirect Plugin cross site scriptingCVE-2026-70124.8 Medium
- maxsite cmsMaxSite CMS Antispam Plugin plugin_antispam cross site scriptingCVE-2026-70114.8 Medium
- pagekit cmsPagekit CMS StringStorage Template PhpEngine.php evaluate eval injectionCVE-2026-66525.1 Medium
- qibo cmsQibo CMS headers server-side request forgeryCVE-2026-66495.3 Medium
- qibo cmsQibo CMS Internal Message cross site scriptingCVE-2026-66485.1 Medium
- statamic cmsYifang CMS Extended Management L_rbac_admin.php store cross site scriptingCVE-2026-66335.1 Medium
- statamic cms, statamic +1 moreStatamic: Unsafe method invocation via query value resolution allows data destructionCVE-2026-41175Fix available8.1 High
- craftcms cmsCraft CMS has a host header injection leading to SSRF via resource-js endpointCVE-2026-41130Fix available5.5 Medium
- craftcms cmsCraft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads MutationsCVE-2026-41129Fix available5.5 Medium
- craftcms cmsCraft CMS has a Missing Authorization Check on User Group Removal via save-permissions ActionCVE-2026-41128Fix available5.3 Medium
- statamic cms, statamic +1 moreStatamic allows unauthorized content access through missing authorization in its revision controllersCVE-2026-33887Fix available5.4 Medium
- statamic cms, statamic +1 moreStatamic's sensitive configuration values are exposed to content editors via Antlers-enabled fieldsCVE-2026-33886Fix available6.5 Medium
- statamic cms, statamic +1 moreStatamic has an Open Redirect on unauthenticated endpoints via URL parsing differentialCVE-2026-33885Fix available6.1 Medium
- statamic cms, statamic +1 moreStatamic's live preview token bypasses content protection for unrelated entriesCVE-2026-33884Fix available4.3 Medium
- statamic cms, statamic +1 moreStatamic has Reflected XSS via unescaped redirect parameter in its password reset form tagCVE-2026-33883Fix available6.1 Medium
- statamic cms, statamic +1 moreStatamic's Markdown preview endpoint exposes sensitive user dataCVE-2026-33882Fix available6.5 Medium
- craftcms cmsCraft CMS - Authorization Bypass in assets/preview-file EndpointCVE-2026-56385Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissionsCVE-2026-33162Fix available4.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized usersCVE-2026-33161Fix available1.3 Low
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URLCVE-2026-33160Fix available2.7 Low
- craftcms cms, craft cms +1 moreCraft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted usersCVE-2026-33159Fix available6.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)CVE-2026-33158Fix available4.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorCVE-2026-33157Public exploitFix available8.6 High
- statamic cms, statamic +1 moreStatamic is missing authorization check on taxonomy term creation via fieldtypeCVE-2026-33177Fix available4.3 Medium
- statamic cms, statamic +1 moreStatamic has a path traversal in file dictionary fieldtypeCVE-2026-33171Fix available4.3 Medium
- statamic cms, statamic +1 moreStatamic has Stored XSS via SVG Sanitization BypassCVE-2026-33172Fix available8.7 High
- craftcms cms, craft cms +1 moreCraft CMS Vulnerable to Stored XSS in Revision Context MenuCVE-2026-33051Fix available5.3 Medium
- craftcms cms, craft cms +1 moreCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()CVE-2026-32267Fix available7.7 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllerCVE-2026-32264Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft CMS vulnerable to behavior injection RCE via EntryTypesControllerCVE-2026-32263Fix available8.6 High
- craftcms cms, craft cms +1 moreCraft CMS has a Path Traversal Vulnerability in AssetsControllerCVE-2026-32262Fix available5.3 Medium
- statamic cms, statamic +1 moreStatamic: privilege escalation via stored cross-site scriptingCVE-2026-32612Fix available5.4 Medium
- craftcms cmsCraft CMS - Stored XSS via User Group Name in User Permissions PageCVE-2026-56381Fix available4.6 Medium
- Show moreLoading…