Login Request a demo
DC
Product
dotCMS core
by dotCMS · last CVE May 27, 2026
6
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 2High 0Medium 4Low 0
Severity
All severities6Critical2High0Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add dotCMS core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-8054
10.0
2%
May 27
Unauthenticated SQL Injection in dotCMS Publish Audit API
Affected: 25.11.04-1 through 26.04.28-02
CVE-2024-4447
9.9
0%
Jul 26
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls
Affected: 4.2.1 before 23.01.20
CVE-2024-3938
6.1
0%
Jul 25
The "reset password" login page accepted an HTML injection via URL parameters
Affected: 5.1.5 and after
CVE-2023-3042
6.1
0%
Oct 17
CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8
Affected: 5.3.8; 21.06; 22.03; 23.01
CVE-2024-3165
4.5
0%
Apr 1
Database Credential Exposure in the Logs
Affected: 22.02 and after
CVE-2024-3164
4.5
0%
Apr 1
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and…
Affected: 22.02 and after
Showing 6