DC
Product
dotCMS core
6
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 2High 0Medium 4Low 0
Watch
Add dotCMS core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8054 | 10.0 | May 27 | Unauthenticated SQL Injection in dotCMS Publish Audit API Affected: 25.11.04-1 through 26.04.28-02 |
| CVE-2024-4447 | 9.9 | Jul 26 | In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls Affected: 4.2.1 before 23.01.20 |
Showing 2