octobercms october

• CVE-2021-32648 High 8.2 Exploited Account Takeover in Octobercms 91.1%
• CVE-2026-49400 Low 3.3 October CMS: PHP Object Injection via Backend Widget Session Storage 0.2%
• CVE-2026-29179 Low 3.3 October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations 0.1%
• CVE-2026-27937 Low 3.1 October: Reflected XSS via DataTable Form Widget 0.1%
• CVE-2026-26274 Medium 6.6 October: Safe Mode Bypass via Twig Database Write Operations 0.2%
• CVE-2026-26067 Medium 4.9 October: Safe Mode Bypass via CSS Preprocessor Compilers 0.2%
• CVE-2026-25133 Medium 4.8 October CMS has Stored XSS via SVG Filter Bypass 0.2%
• CVE-2026-25125 Medium 4.9 October CMS: Environment Variable Exfiltration via INI Parser Interpolation 0.3%
• CVE-2026-24907 Medium 5.1 October CMS has Stored XSS via Event Log Mail Preview 0.2%
• CVE-2026-24906 Medium 5.1 October CMS has Stored XSS in its Backend Editor Markup Classes 0.3%
• CVE-2026-22692 Medium 4.9 October CMS: Twig Sandbox Bypass via Collection Methods 0.4%
• CVE-2025-61674 Medium 6.1 October CMS Vulnerable to Stored XSS via Editor and Branding Styles 0.3%
• CVE-2025-61676 Medium 6.1 October CMS Vulnerable to Stored XSS via Branding Styles 0.3%
• CVE-2024-51991 Low 1.1 October CMS Allows Unprotected SVG Rename in Media Manager 0.4%
• CVE-2024-25637 Low 3.1 Reflected XSS via X-October-Request-Handler Header 0.3%
• CVE-2024-24764 Low 3.5 October Open Redirect for Administrator Accounts 0.3%
• CVE-2023-44381 Medium 4.9 October CMS safe mode bypass using Page template injection 0.5%
• CVE-2023-44382 Critical 9.1 October CMS safe mode bypass using Twig sandbox escape 0.9%
• CVE-2023-44383 Medium 5.4 October CMS stored XSS by authenticated backend user with improper configuration 0.4%
• CVE-2022-35944 Medium 6.2 October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) 1.1%
• CVE-2022-24800 High 8.1 Race Condition in October CMS upload process 1.5%
• CVE-2022-23655 Medium 4.8 Missing server signature validation in OctoberCMS 0.6%
• CVE-2022-21705 High 7.2 Authenticated remote code execution in octobercms 8.6%
• CVE-2021-32649 High 8.8 Authenticated file write leads to remote code execution in october/system 1.3%
• CVE-2021-32650 High 8.8 Arbitrary code execution in october/system 2.1%
• CVE-2021-41126 High 7.2 Deleted Admin Can Sign In to Admin Interface 1.1%
• CVE-2021-29487 High 7.4 Authentication bypass in Octobercms 0.9%
• CVE-2021-21264 Medium 5.2 Bypass of fix for CVE-2020-26231, Twig sandbox escape 0.3%
• CVE-2021-21265 Medium 6.8 October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers 1.7%
• CVE-2020-26231 Medium 5.2 Bypass of fix for CVE-2020-15247, Twig sandbox escape 0.3%
• CVE-2020-15249 Low 2.8 Stored XSS by authenticated backend user with access to upload files 0.5%
• CVE-2020-15248 Medium 4.0 Privilege escalation by backend users assigned to the default "Publisher" system role 0.3%
• CVE-2020-15247 Medium 5.2 Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. 0.3%
• CVE-2020-15246 High 7.5 Local File Inclusion by unauthenticated users 1.7%
• CVE-2020-15128 Medium 6.1 Reliance on Cookies without validation in OctoberCMS 0.7%
• CVE-2020-5299 Medium 4.0 Potential CSV Injection vector in OctoberCMS 1.0%
• CVE-2020-5296 Medium 6.2 Arbitrary File Deletion vulnerability in OctoberCMS 1.4%
• CVE-2020-5297 Low 3.4 Upload whitelisted files to any directory in OctoberCMS 1.2%
• CVE-2020-5298 Medium 4.0 Reflected XSS when importing CSV in OctoberCMS 0.9%
• CVE-2020-5295 Medium 4.8 Local File read vulnerability in OctoberCMS 7.4%