CraftCMS cms

• CVE-2025-32432 Critical 10.0 Exploited Craft CMS Allows Remote Code Execution 99.8%
• CVE-2025-23209 High 8.1 Exploited Potential RCE with a compromised security key in craft/cms 21.6%
• CVE-2024-56145 Critical 9.3 Exploited RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms 97.5%
• CVE-2026-115938 High 8.8 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE 0.4%
• CVE-2026-115935 High 8.8 Control panel only API response emulation replaces "securityKey" and reaches server RCE 0.4%
• CVE-2026-112777 High 7.2 Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE 0.6%
• CVE-2026-112776 Critical 9.8 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations 0.4%
• CVE-2026-112775 High 7.5 Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password 0.4%
• CVE-2026-112774 High 7.2 Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout 0.6%
• CVE-2026-112773 High 8.8 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection 0.7%
• CVE-2026-112772 High 8.8 Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection 0.7%
• CVE-2026-112771 Medium 6.5 Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters 0.3%
• CVE-2026-112770 High 8.8 Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable 0.7%
• CVE-2026-109308 High 8.8 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection 0.5%
• CVE-2026-109307 Medium 4.7 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification 0.2%
• CVE-2026-109306 Medium 5.9 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition 0.2%
• CVE-2026-109305 High 8.8 Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every 0.5%
• CVE-2026-109304 Medium 4.9 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument 0.3%
• CVE-2026-105985 High 8.8 Authenticated RCE via render-components Entry Type overrides 0.7%
• CVE-2026-92594 High 7.5 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL 0.4%
• CVE-2026-92593 High 8.8 Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution 0.5%
• CVE-2026-92592 High 8.8 Craft CMS before 4.18.6 Remote Code Execution via signed cookie 0.6%
• CVE-2026-92591 Medium 5.9 Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer 0.4%
• CVE-2026-92590 Medium 5.4 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields 0.2%
• CVE-2026-92589 Medium 4.3 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder 0.3%
• CVE-2026-79987 High 8.8 Low-privilege RCE through element-search eager loading 0.6%
• CVE-2026-86732 High 8.8 Craft CMS before 5.10.12 Remote Code Execution via element-index 0.9%
• CVE-2026-86731 Medium 6.5 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController 0.3%
• CVE-2026-86730 High 8.8 Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE 0.7%
• CVE-2026-79991 High 7.1 Authenticated SQL Injection via nested eager-loading criteria 0.5%
• CVE-2026-79990 High 8.7 GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete 0.4%
• CVE-2026-79989 High 8.7 Arbitrary user password reset leading to administrator account takeover 0.4%
• CVE-2026-84802 Medium 4.3 Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController 0.3%
• CVE-2026-84801 High 8.8 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers 0.4%
• CVE-2026-84800 High 7.1 Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file 0.4%
• CVE-2026-84799 Medium 4.3 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations 0.3%
• CVE-2026-84798 High 7.1 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite 0.4%
• CVE-2026-84797 Medium 6.3 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate 0.3%
• CVE-2026-84796 High 8.8 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass 0.5%
• CVE-2026-84795 Critical 9.8 Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance 0.5%
• CVE-2026-84794 High 7.1 Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset 0.4%
• CVE-2026-84793 Medium 4.8 Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name 0.3%
• CVE-2026-84792 Medium 4.3 Craft CMS before 5.10.11 Broken Access Control via element-indexes 0.3%
• CVE-2026-79988 High 8.7 Authenticated RCE through Twig sandbox escape 0.5%
• CVE-2026-78416 High 8.7 Authenticated RCE via `condition.config` JSON cleanse bypass 1.0%
• CVE-2026-72787 Medium 6.4 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name 0.3%
• CVE-2026-72786 Medium 6.5 Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset 0.5%
• CVE-2026-72785 Medium 4.3 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element 0.3%
• CVE-2026-72784 Medium 5.4 Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation 0.2%
• CVE-2026-72783 Medium 6.2 Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained 0.2%