CM
Product
cms
On CISA KEVExploited in the wild
130
CVEs
3
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 9High 60Medium 61Low 0
Watch
Add cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-92589 | 4.3 | Sep 16 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder Affected: 5.0.0 before 5.10.13 |
| CVE-2026-84802 | 4.3 | Sep 2 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController Affected: 5.7.0 before 5.10.12 |
| CVE-2026-84799 | 4.3 | Sep 2 | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations Affected: 5.0.0-RC1 before 5.11.0 |
| CVE-2026-84792 | 4.3 | Sep 2 | Craft CMS before 5.10.11 Broken Access Control via element-indexes Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-72785 | 4.3 | Aug 11 | Craft CMS before 5.10.6 Authorization Bypass via structures/move-element Affected: 5.0.0-RC1 before 5.10.6 |
| CVE-2026-56385 | 4.3 | Jun 21 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint Affected: 5.0.0-RC1 before 5.9.14; 4.0.0-RC1 before 4.17.8 |
| CVE-2026-56384 | 4.3 | Jun 21 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint Affected: 4.0.0-RC1 before 4.17.8; 5.0.0-RC1 before 5.9.14 |
| CVE-2026-33161 | 4.3 | Mar 24 | Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-32262 | 4.3 | Mar 16 | Craft CMS has a Path Traversal Vulnerability in AssetsController Affected: >= 4.0.0-RC1, < 4.17.5; >= 5.0.0-RC1, < 5.9.11 |
| CVE-2026-29113 | 4.3 | Mar 10 | Craft has a potential information disclosure vulnerability in preview tokens Affected: >= 4.0.0-RC1, < 4.17.3; >= 5.0.0-RC1, < 5.9.7 |
| CVE-2026-28782 | 4.3 | Mar 4 | Craft has a Permission Bypass and IDOR in Duplicate Entry Action Affected: >= 5.0.0-RC1, < 5.9.0-beta.1; >= 4.0.0-RC1, < 4.17.0-beta.1 |