octobercms

Products

Exploited and recent CVEs

• CVE-2021-32648 High 8.2 Exploited Account Takeover in Octobercms 91.1%
• CVE-2026-49400 Low 3.3 October CMS: PHP Object Injection via Backend Widget Session Storage 0.2%
• CVE-2026-46696 Low 3.3 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls 0.3%
• CVE-2026-29179 Low 3.3 October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations 0.1%
• CVE-2026-27937 Low 3.1 October: Reflected XSS via DataTable Form Widget 0.1%
• CVE-2026-26274 Medium 6.6 October: Safe Mode Bypass via Twig Database Write Operations 0.2%
• CVE-2026-26067 Medium 4.9 October: Safe Mode Bypass via CSS Preprocessor Compilers 0.2%
• CVE-2026-25133 Medium 4.8 October CMS has Stored XSS via SVG Filter Bypass 0.2%
• CVE-2026-25125 Medium 4.9 October CMS: Environment Variable Exfiltration via INI Parser Interpolation 0.3%
• CVE-2026-24907 Medium 5.1 October CMS has Stored XSS via Event Log Mail Preview 0.2%
• CVE-2026-24906 Medium 5.1 October CMS has Stored XSS in its Backend Editor Markup Classes 0.3%
• CVE-2026-22692 Medium 4.9 October CMS: Twig Sandbox Bypass via Collection Methods 0.4%
• CVE-2025-61674 Medium 6.1 October CMS Vulnerable to Stored XSS via Editor and Branding Styles 0.3%
• CVE-2025-61676 Medium 6.1 October CMS Vulnerable to Stored XSS via Branding Styles 0.3%
• CVE-2024-51991 Low 1.1 October CMS Allows Unprotected SVG Rename in Media Manager 0.4%
• CVE-2024-25637 Low 3.1 Reflected XSS via X-October-Request-Handler Header 0.3%
• CVE-2024-24764 Low 3.5 October Open Redirect for Administrator Accounts 0.3%
• CVE-2023-44381 Medium 4.9 October CMS safe mode bypass using Page template injection 0.5%
• CVE-2023-44382 Critical 9.1 October CMS safe mode bypass using Twig sandbox escape 0.9%
• CVE-2023-44383 Medium 5.4 October CMS stored XSS by authenticated backend user with improper configuration 0.4%
• CVE-2022-35944 Medium 6.2 October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) 1.1%
• CVE-2022-24800 High 8.1 Race Condition in October CMS upload process 1.5%
• CVE-2022-23655 Medium 4.8 Missing server signature validation in OctoberCMS 0.6%
• CVE-2022-21705 High 7.2 Authenticated remote code execution in octobercms 8.6%
• CVE-2021-32649 High 8.8 Authenticated file write leads to remote code execution in october/system 1.3%
• CVE-2021-32650 High 8.8 Arbitrary code execution in october/system 2.1%
• CVE-2021-41126 High 7.2 Deleted Admin Can Sign In to Admin Interface 1.1%
• CVE-2021-29487 High 7.4 Authentication bypass in Octobercms 0.9%
• CVE-2021-21264 Medium 5.2 Bypass of fix for CVE-2020-26231, Twig sandbox escape 0.3%
• CVE-2021-21265 Medium 6.8 October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers 1.7%