CM
Product
cms
On CISA KEVExploited in the wild
136
CVEs
3
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 9High 61Medium 66Low 0
Watch
Add cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41130 | 5.5 | Apr 21 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint Affected: >= 5.0.0-RC1, < 5.9.15; >= 4.0.0-RC1, < 4.17.9 |
| CVE-2026-41129 | 5.5 | Apr 21 | Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations Affected: >= 5.0.0-RC1, < 5.9.15; >= 4.0.0-RC1, < 4.17.9 |
| CVE-2026-92590 | 5.4 | Sep 16 | Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields Affected: 5.7.0 before 5.10.13 |
| CVE-2026-72784 | 5.4 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-33051 | 5.4 | Mar 20 | Craft CMS Vulnerable to Stored XSS in Revision Context Menu Affected: >= 5.9.0-beta.1, < 5.9.11 |
| CVE-2023-33196 | 5.4 | May 26 | Craft CMS stored XSS in review volume Affected: >= 4.0.0-RC1, <= 4.4.6 |
| CVE-2023-33197 | 5.4 | May 26 | Craft CMS stored XSS in indexedVolumes Affected: >= 4.0.0-RC1, <= 4.4.5 |
| CVE-2026-50283 | 5.3 | Jul 1 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement Affected: >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, < 4.17.14 |
| CVE-2026-41128 | 5.3 | Apr 21 | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action Affected: >= 5.6.0, < 5.9.15 |
| CVE-2026-33160 | 5.3 | Mar 24 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-29069 | 5.3 | Mar 4 | Craft has an unauthenticated activation email trigger with potential user enumeration Affected: >= 5.0.0-RC1, < 5.9.0-beta.2; >= 4.0.0-RC1, < 4.17.0-beta.2 |
| CVE-2026-109304 | 4.9 | Oct 12 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument Affected: 4.0.0 before 4.18.7; 5.0.0 before 5.10.14 |
| CVE-2026-50282 | 4.9 | Jul 2 | Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves Affected: >= 5.0.0-RC1, < 5.9.21; >= 4.0.0-RC1, <= 4.17.14 |
| CVE-2026-84793 | 4.8 | Sep 2 | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-56393 | 4.8 | Jun 21 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options Affected: 5.0.0-RC1 before 5.9.0-beta.1; 4.0.0-RC1 before 4.17.0-beta.1 |
| CVE-2026-56383 | 4.8 | Jun 21 | Craft CMS - Stored XSS in Table Field via Row Heading Column Type Affected: 4.5.0-beta.1 before 4.16.19; 5.0.0-RC1 before 5.8.23 |
| CVE-2026-56381 | 4.8 | Jun 21 | Craft CMS - Stored XSS via User Group Name in User Permissions Page Affected: 5.0.0-RC1 before 5.8.22 |
| CVE-2026-27128 | 4.8 | Feb 24 | Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-27126 | 4.8 | Feb 24 | Craft CMS has Stored XSS in Table Field via "HTML" Column Type Affected: >= 4.5.0-RC1, < 4.16.19; >= 5.0.0-RC1, < 5.8.23 |
| CVE-2026-25496 | 4.8 | Feb 9 | Craft has a stored XSS in Number Prefix & Suffix Fields Affected: >= 5.0.0-RC1, < 5.8.22; >= 4.0.0-RC1, < 4.16.18 |
| CVE-2026-25491 | 4.8 | Feb 9 | Craft has a Stored XSS in Entry Types Name Affected: >= 5.0.0-RC1, < 5.8.22 |
| CVE-2024-45406 | 4.8 | Sep 9 | Craft CMS stored XSS in breadcrumb list and title fields Affected: >= 5.0.0, < 5.1.2 |
| CVE-2023-33194 | 4.8 | May 26 | CraftCMS stored XSS in Quick Post widget error message Affected: >= 4.0.0-RC1, < 4.4.6; >= 3.0.0, <= 3.8.5 |
| CVE-2026-109307 | 4.7 | Oct 12 | Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification Affected: 5.0.0 before 5.10.14 |
| CVE-2026-72779 | 4.5 | Aug 11 | Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject Affected: 5.0.0-RC1 before 5.10.6; 4.0.0-RC1 before 4.18.2 |
| CVE-2026-92589 | 4.3 | Sep 16 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder Affected: 5.0.0 before 5.10.13 |
| CVE-2026-84802 | 4.3 | Sep 2 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController Affected: 5.7.0 before 5.10.12 |
| CVE-2026-84799 | 4.3 | Sep 2 | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations Affected: 5.0.0-RC1 before 5.11.0 |
| CVE-2026-84792 | 4.3 | Sep 2 | Craft CMS before 5.10.11 Broken Access Control via element-indexes Affected: 5.0.0-RC1 before 5.10.11 |
| CVE-2026-72785 | 4.3 | Aug 11 | Craft CMS before 5.10.6 Authorization Bypass via structures/move-element Affected: 5.0.0-RC1 before 5.10.6 |
| CVE-2026-56385 | 4.3 | Jun 21 | Craft CMS - Authorization Bypass in assets/preview-file Endpoint Affected: 5.0.0-RC1 before 5.9.14; 4.0.0-RC1 before 4.17.8 |
| CVE-2026-56384 | 4.3 | Jun 21 | Craft CMS - Missing Authorization in assets/preview-thumb Endpoint Affected: 4.0.0-RC1 before 4.17.8; 5.0.0-RC1 before 5.9.14 |
| CVE-2026-33161 | 4.3 | Mar 24 | Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users Affected: >= 4.0.0-RC1, < 4.17.8; >= 5.0.0-RC1, < 5.9.14 |
| CVE-2026-32262 | 4.3 | Mar 16 | Craft CMS has a Path Traversal Vulnerability in AssetsController Affected: >= 4.0.0-RC1, < 4.17.5; >= 5.0.0-RC1, < 5.9.11 |
| CVE-2026-29113 | 4.3 | Mar 10 | Craft has a potential information disclosure vulnerability in preview tokens Affected: >= 4.0.0-RC1, < 4.17.3; >= 5.0.0-RC1, < 5.9.7 |
| CVE-2026-28782 | 4.3 | Mar 4 | Craft has a Permission Bypass and IDOR in Duplicate Entry Action Affected: >= 5.0.0-RC1, < 5.9.0-beta.1; >= 4.0.0-RC1, < 4.17.0-beta.1 |