CraftCMS

Products

Exploited and recent CVEs

• CVE-2025-32432 Critical 10.0 Exploited Craft CMS Allows Remote Code Execution 99.8%
• CVE-2025-23209 High 8.1 Exploited Potential RCE with a compromised security key in craft/cms 21.6%
• CVE-2024-56145 Critical 9.3 Exploited RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms 97.5%
• CVE-2026-115938 High 8.8 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE 0.4%
• CVE-2026-115937 High 7.5 Unauthenticated payment reuse allows unpaid orders to be marked as paid 0.2%
• CVE-2026-115935 High 8.8 Control panel only API response emulation replaces "securityKey" and reaches server RCE 0.4%
• CVE-2026-112777 High 7.2 Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE 0.6%
• CVE-2026-112776 Critical 9.8 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations 0.4%
• CVE-2026-112775 High 7.5 Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password 0.4%
• CVE-2026-112774 High 7.2 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout 0.6%
• CVE-2026-112773 High 8.8 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection 0.7%
• CVE-2026-112772 High 8.8 Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection 0.7%
• CVE-2026-112771 Medium 6.5 Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters 0.3%
• CVE-2026-112770 High 8.8 Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable 0.7%
• CVE-2026-109308 High 8.8 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection 0.5%
• CVE-2026-109307 Medium 4.7 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification 0.2%
• CVE-2026-109306 Medium 5.9 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition 0.2%
• CVE-2026-109305 High 8.8 Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every 0.5%
• CVE-2026-109304 Medium 4.9 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument 0.3%
• CVE-2026-105985 High 8.8 Authenticated RCE via render-components Entry Type overrides 0.7%
• CVE-2026-92594 High 7.5 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL 0.4%
• CVE-2026-92593 High 8.8 Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution 0.5%
• CVE-2026-92592 High 8.8 Craft CMS before 4.18.6 Remote Code Execution via signed cookie 0.6%
• CVE-2026-92591 Medium 5.9 Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer 0.4%
• CVE-2026-92590 Medium 5.4 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields 0.2%
• CVE-2026-92589 Medium 4.3 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder 0.3%
• CVE-2026-55795 Medium 6.9 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass 0.5%
• CVE-2026-79987 High 8.8 Low-privilege RCE through element-search eager loading 0.6%
• CVE-2026-86732 High 8.8 Craft CMS before 5.10.12 Remote Code Execution via element-index 0.9%
• CVE-2026-86731 Medium 6.5 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController 0.3%