statamic

Products

Exploited and recent CVEs

• CVE-2026-71435 Medium 6.1 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template 0.3%
• CVE-2026-71434 Medium 5.3 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types 0.4%
• CVE-2026-64662 Medium 6.5 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries 0.4%
• CVE-2026-64663 Medium 6.5 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction 0.4%
• CVE-2026-64665 High 8.1 Statamic: Account takeover via OAuth email matching without email-verification check 0.5%
• CVE-2026-64664 Medium 4.3 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence 0.3%
• CVE-2026-71293 Medium 6.2 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable 0.4%
• CVE-2026-54243 Medium 6.1 Statamic: CSV formula injection in form submission exports 0.3%
• CVE-2026-54242 Medium 4.9 Statamic: Server-Side Request Forgery via Glide (DNS rebinding) 0.2%
• CVE-2026-54244 Low 3.5 Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors 0.3%
• CVE-2026-49288 Medium 4.3 Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources 0.3%
• CVE-2026-49287 High 7.4 Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction 0.5%
• CVE-2026-45660 Medium 5.4 Statamic: Server-Side Request Forgery via Glide 0.2%
• CVE-2026-44306 Medium 5.3 Statamic: Email enumeration via forgot password endpoint 0.2%
• CVE-2026-41175 High 8.1 Statamic: Unsafe method invocation via query value resolution allows data destruction 0.3%
• CVE-2026-33887 Medium 5.4 Statamic allows unauthorized content access through missing authorization in its revision controllers 0.1%
• CVE-2026-33886 Medium 6.5 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields 0.2%
• CVE-2026-33885 Medium 6.1 Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential 0.2%
• CVE-2026-33884 Medium 4.3 Statamic's live preview token bypasses content protection for unrelated entries 0.2%
• CVE-2026-33883 Medium 6.1 Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag 0.2%
• CVE-2026-33882 Medium 6.5 Statamic's Markdown preview endpoint exposes sensitive user data 0.3%
• CVE-2026-33177 Medium 4.3 Statamic is missing authorization check on taxonomy term creation via fieldtype 0.2%
• CVE-2026-33172 High 8.7 Statamic has Stored XSS via SVG Sanitization Bypass 0.3%
• CVE-2026-33171 Medium 4.3 Statamic has a path traversal in file dictionary fieldtype 0.4%
• CVE-2026-32612 Medium 5.4 Statamic: privilege escalation via stored cross-site scripting 0.2%
• CVE-2026-28426 High 8.7 Statamic vulnerable to privilege escalation via stored cross-site scripting 0.3%
• CVE-2026-28425 High 8.0 Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs 0.5%
• CVE-2026-28424 Medium 6.5 Statamic's missing authorization allows access to email addresses 0.3%
• CVE-2026-28423 Medium 6.8 Statamic Vulnerable to Server-Side Request Forgery via Glide 0.4%
• CVE-2026-27939 High 8.8 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass 0.4%