CM
Product
cms
On CISA KEVExploited in the wild
137
CVEs
3
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 9High 61Medium 67Low 0
Watch
Add cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-52293 | 7.2 | Nov 13 | Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI Affected: >= 4.0.0-RC1, < 4.12.2; >= 5.0.0-RC1, < 5.4.3 |
| CVE-2023-40035 | 7.2 | Aug 23 | Craft CMS vulnerable to Remote Code Execution via validatePath bypass Affected: >= 4.0.0-RC1, < 4.4.15; >= 3.0.0, < 3.8.15 |
| CVE-2023-32679 | 7.2 | May 19 | Remote Code Execution via unrestricted file extension in Craft CMS Affected: >= 4.0.0, < 4.4.6 |
| CVE-2026-79991 | 7.1 | Sep 2 | Authenticated SQL Injection via nested eager-loading criteria Affected: 5.0.0-RC1 before 5.10.13 |
| CVE-2026-84800 | 7.1 | Sep 2 | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-84798 | 7.1 | Sep 2 | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-84794 | 7.1 | Sep 2 | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-50281 | 7.1 | Jul 2 | Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements Affected: >= 5.7.0, < 5.9.21 |
| CVE-2026-50284 | 7.1 | Jul 1 | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets Affected: =>= 5.0.0-RC1, < 5.9.22; >= 4.0.0-RC1, < 4.17.15 |
| CVE-2026-44012 | 7.1 | May 12 | Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure Affected: >= 5.0.0-RC1, < 5.9.18 |
| CVE-2026-44010 | 7.1 | May 12 | Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure Affected: >= 5.0.0, < 5.9.18; >= 4.0.0, < 4.17.12 |