Skip to contentStatamic vulnerabilities
Newest
- craftcms cmsGQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/deleteCVE-2026-799908.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicateCVE-2026-847975.3 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope BypassCVE-2026-847968.7 High
- craftcms cmsCraft CMS before 5.10.11 Authentication Bypass via Admin Flag InheritanceCVE-2026-847959.2 Critical
- craftcms cmsCraft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-assetCVE-2026-847947.1 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site nameCVE-2026-847934.8 Medium
- craftcms cmsCraft CMS before 5.10.11 Broken Access Control via element-indexesCVE-2026-847925.3 Medium
- craftcms cmsAuthenticated RCE through Twig sandbox escapeCVE-2026-799888.7 High
- craftcms cmsAuthenticated RCE via `condition.config` JSON cleanse bypassCVE-2026-784168.7 High
- azuriom cmsAzuriom CMS Money Transfer ProfileController.php transferMoney toctouCVE-2026-19975Public exploit2.3 Low
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutationCVE-2026-727846.9 Medium
- craftcms cmsCraft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkeyCVE-2026-72780Fix available7.1 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObjectCVE-2026-72779Fix available8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 Environment Variable LeakCVE-2026-72782Fix available7.1 High
- craftcms cmsCraft CMS before 5.10.6 Authorization Bypass via structures/move-elementCVE-2026-72785Fix available9.3 Critical
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContainedCVE-2026-72783Fix available6.9 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameCVE-2026-72787Fix available5.1 Medium
- craftcms cmsArbitrary user password reset leading to administrator account takeoverCVE-2026-79989Fix available8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password ResetCVE-2026-72786Fix available7.1 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox EscapeCVE-2026-72781Public exploitFix available8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configCVE-2026-72778Public exploitFix available8.7 High
- statamic cmsStatamic: Stored Cross-Site Scripting in Automagic Form Notification Email TemplateCVE-2026-71435Fix available6.1 Medium
- statamic cmsStatamic: Missing file upload validation on frontend forms allows uploading disallowed file typesCVE-2026-71434Fix available5.3 Medium
- statamic cmsStatamic: Missing authorization on navigation endpoint allows disclosure of restricted entriesCVE-2026-64662Fix available6.5 Medium
- statamic cmsStatamic: Unsafe method invocation via Antlers template resolution allows data destructionCVE-2026-64663Fix available6.5 Medium
- statamic cmsStatamic: Account takeover via OAuth email matching without email-verification checkCVE-2026-64665Fix available8.1 High
- statamic cmsStatamic: Missing authorization on Control Panel endpoint allows disclosure of user existenceCVE-2026-64664Fix available4.3 Medium
- loca software informatics technology ltd. co. cmsSQLi in Loca Software's CMSCVE-2026-51349.8 Critical
- statamic cmsStatamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user VariableCVE-2026-712936.2 Medium
- croogo cmsCroogo CMS Admin File Manager FileManager.php isEditable path traversalCVE-2026-16219Public exploit5.3 Medium
- pluck cmsPluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scriptingCVE-2026-162054.8 Medium
- mura software cmsRemote code execution in Mura Software’s CMSCVE-2026-122579.3 Critical
- craft cmsCraft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorizationCVE-2026-14794Fix available5.3 Medium
- craft cmsCraft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorizationCVE-2026-14793Fix available5.3 Medium
- craftcms cmsCraft CMS: Unauthorized Deletion of Destination Folders During Forced MovesCVE-2026-50282Fix available4.9 Medium
- craftcms cmsCraft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsCVE-2026-50281Fix available7.1 High
- craftcms cmsCraft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save checkCVE-2026-50280Fix available6.0 Medium
- craftcms cmsCraft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapCVE-2026-50279Fix available7.6 High
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via referrer redirectCVE-2026-55794Public exploitFix available8.7 High
- craftcms cmsCraft CMS: Sensitive File Disclosure / Server-Side File ReadCVE-2026-55792Fix available6.0 Medium
- craftcms cmsCraft CMS: DOM XSS via GitHub issue title in CraftSupport widgetCVE-2026-55790Fix available7.4 High
- craftcms cmsCraft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assetsCVE-2026-50284Fix available7.1 High
- craftcms cmsCraft CMS: Unauthorized Deletion of Source Assets During File ReplacementCVE-2026-50283Fix available5.3 Medium
- craftcms cmsCraft CMS: Stored XSS via Structure entry title in table viewCVE-2026-55793Fix available5.9 Medium
- feehi cmsFeehi CMS REST API Endpoint articles missing authenticationCVE-2026-135466.9 Medium
- feehi cmsFeehi CMS API users access controlCVE-2026-135445.3 Medium
- statamic cmsStatamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editorsCVE-2026-54244Fix available3.5 Low
- statamic cmsStatamic: CSV formula injection in form submission exportsCVE-2026-54243Fix available6.1 Medium
- statamic cmsStatamic: Server-Side Request Forgery via Glide (DNS rebinding)CVE-2026-54242Fix available4.9 Medium
- craftcms cmsCraft CMS - Authenticated Path Traversal in assets/icon Extension ParameterCVE-2026-56394Fix available7.1 High
- Show moreLoading…