statamic cms

• CVE-2026-71435 Medium 6.1 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template 0.3%
• CVE-2026-71434 Medium 5.3 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types 0.4%
• CVE-2026-64662 Medium 6.5 Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries 0.4%
• CVE-2026-64663 Medium 6.5 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction 0.4%
• CVE-2026-64665 High 8.1 Statamic: Account takeover via OAuth email matching without email-verification check 0.5%
• CVE-2026-64664 Medium 4.3 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence 0.3%
• CVE-2026-71293 Medium 6.2 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable 0.4%
• CVE-2026-54243 Medium 6.1 Statamic: CSV formula injection in form submission exports 0.3%
• CVE-2026-54242 Medium 4.9 Statamic: Server-Side Request Forgery via Glide (DNS rebinding) 0.2%
• CVE-2026-54244 Low 3.5 Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors 0.3%
• CVE-2026-49288 Medium 4.3 Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources 0.3%
• CVE-2026-49287 High 7.4 Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction 0.5%
• CVE-2026-45660 Medium 5.4 Statamic: Server-Side Request Forgery via Glide 0.2%
• CVE-2026-44306 Medium 5.3 Statamic: Email enumeration via forgot password endpoint 0.2%
• CVE-2026-41175 High 8.1 Statamic: Unsafe method invocation via query value resolution allows data destruction 0.3%
• CVE-2026-33887 Medium 5.4 Statamic allows unauthorized content access through missing authorization in its revision controllers 0.1%
• CVE-2026-33886 Medium 6.5 Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields 0.2%
• CVE-2026-33885 Medium 6.1 Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential 0.2%
• CVE-2026-33884 Medium 4.3 Statamic's live preview token bypasses content protection for unrelated entries 0.2%
• CVE-2026-33883 Medium 6.1 Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag 0.2%
• CVE-2026-33882 Medium 6.5 Statamic's Markdown preview endpoint exposes sensitive user data 0.3%
• CVE-2026-33177 Medium 4.3 Statamic is missing authorization check on taxonomy term creation via fieldtype 0.2%
• CVE-2026-33172 High 8.7 Statamic has Stored XSS via SVG Sanitization Bypass 0.3%
• CVE-2026-33171 Medium 4.3 Statamic has a path traversal in file dictionary fieldtype 0.4%
• CVE-2026-32612 Medium 5.4 Statamic: privilege escalation via stored cross-site scripting 0.2%
• CVE-2026-28426 High 8.7 Statamic vulnerable to privilege escalation via stored cross-site scripting 0.3%
• CVE-2026-28425 High 8.0 Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs 0.5%
• CVE-2026-28424 Medium 6.5 Statamic's missing authorization allows access to email addresses 0.3%
• CVE-2026-28423 Medium 6.8 Statamic Vulnerable to Server-Side Request Forgery via Glide 0.4%
• CVE-2026-27939 High 8.8 Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass 0.4%
• CVE-2026-27593 Critical 9.3 Statamic is vulnerable to account takeover via password reset link injection 0.5%
• CVE-2026-27196 High 8.1 Statamic affected by privilege escalation via stored Cross-site Scripting 0.3%
• CVE-2026-25759 High 8.7 Statmatic affected by privilege escalation via stored cross-site scripting 0.3%
• CVE-2026-25633 Medium 4.3 Statamic's missing authorization allows access to assets 0.3%
• CVE-2025-64112 High 8.0 Statmatic vulnerable to Stored Cross-Site Scripting 0.3%
• CVE-2024-52600 Medium 5.3 Statamic CMS has Path Traversal in Asset Upload 0.6%
• CVE-2024-36119 Low 1.8 Password confirmation stored in plain text via registration form in statamic/cms 0.1%
• CVE-2024-24570 High 8.2 Statamic account takeover via XSS and password reset link 0.7%
• CVE-2023-48701 High 7.5 Statamic CMS vulnerable to Cross-site Scripting via uploaded assets 0.7%
• CVE-2023-48217 High 8.8 Remote code execution via form uploads in statamic/cms 1.1%
• CVE-2023-47129 High 8.4 Statamic CMS remote code execution via front-end form uploads 1.1%
• CVE-2023-36828 Medium 5.5 Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG 0.7%
• CVE-2022-24784 Low 3.7 Discoverability of user password hash in Statamic CMS 1.0%