CraftCMS cms

• CVE-2026-28696 High 8.7 Craft affected by IDOR via GraphQL @parseRefs 0.5%
• CVE-2026-28695 High 7.5 Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget 0.7%
• CVE-2026-27129 Medium 5.7 Cloud Metadata SSRF Protection Bypass via IPv6 Resolution 0.5%
• CVE-2026-27128 Medium 6.9 Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit 0.2%
• CVE-2026-27127 High 7.0 Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding 0.5%
• CVE-2026-27126 Medium 5.9 Craft CMS has Stored XSS in Table Field via "HTML" Column Type 0.2%
• CVE-2026-25498 High 8.6 Craft has a potential authenticated Remote Code Execution via malicious attached Behavior 1.1%
• CVE-2026-25497 High 8.6 Craft has a GraphQL Asset Mutation Privilege Escalation 0.5%
• CVE-2026-25496 Medium 4.8 Craft has a stored XSS in Number Prefix & Suffix Fields 0.4%
• CVE-2026-25495 High 8.7 Craft has a SQL Injection in Element Indexes via criteria[orderBy] 0.6%
• CVE-2026-25494 Medium 6.9 Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation 0.4%
• CVE-2026-25493 Medium 6.9 Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect 0.4%
• CVE-2026-25492 Medium 5.3 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host 0.5%
• CVE-2026-25491 Low 1.9 Craft has a Stored XSS in Entry Types Name 0.4%
• CVE-2025-68456 High 7.0 Unauthenticated Craft CMS users can trigger a database backup 0.6%
• CVE-2025-68455 High 8.6 Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior 1.0%
• CVE-2025-68454 Medium 5.2 Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI 0.9%
• CVE-2025-68437 Medium 5.0 Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation 0.5%
• CVE-2025-68436 Medium 4.9 Craft CMS vulnerable to potential information disclosure via unchecked asset relocation 0.3%
• CVE-2025-57811 Medium 6.1 Craft Potential Remote Code Execution via Twig SSTI 0.9%
• CVE-2025-54417 Medium 5.2 Craft contains a theoretical bypass for CVE-2025-23209 0.5%
• CVE-2025-46731 High 7.3 Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI 1.5%
• CVE-2024-52291 High 8.5 Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution 1.3%
• CVE-2024-52292 High 7.7 Craft Allows Attackers to Read Arbitrary System Files 0.7%
• CVE-2024-52293 High 7.2 Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI 1.4%
• CVE-2024-45406 Medium 5.5 Craft CMS stored XSS in breadcrumb list and title fields 0.4%
• CVE-2024-41800 Medium 4.8 Craft CMS Allows TOTP Token To Stay Valid After Use 0.5%
• CVE-2024-21622 Medium 5.4 Craft CMS Privilege Escalation 0.6%
• CVE-2023-41892 Critical 10.0 Craft CMS Remote Code Execution vulnerability 94.2%
• CVE-2023-40035 High 7.2 Craft CMS vulnerable to Remote Code Execution via validatePath bypass 2.3%
• CVE-2023-33195 Medium 5.0 Craft CMS XSS in RSS widget feed 0.7%
• CVE-2023-33194 Low 3.7 CraftCMS stored XSS in Quick Post widget error message 0.6%
• CVE-2023-33196 Medium 5.5 Craft CMS stored XSS in review volume 0.7%
• CVE-2023-33197 Medium 5.5 Craft CMS stored XSS in indexedVolumes 0.7%
• CVE-2023-32679 High 7.2 Remote Code Execution via unrestricted file extension in Craft CMS 1.8%
• CVE-2023-31144 Medium 6.1 Craft CMS vulnerable to cross site scripting in RSS feed widget 0.4%
• CVE-2023-23927 Medium 6.1 Craft CMS stored cross-site scripting vulnerability 0.8%