craftcms
- Total products in the ecosystem
- 8
- Total vulnerabilities (90 days)
- 64
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, craftcms recorded 64 security vulnerabilities in the last 90 days across 3 products, including 48 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, cms had the most security vulnerabilities in the craftcms ecosystem, with 62 vulnerabilities—approximately 96.88% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset ReplacementCVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing OracleCVE-2026-124429Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public RegistrationCVE-2026-124428Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svgCVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement | Exploitation statusNot confirmed | FixYes |
| Published11/08/2026 |
| SeverityMedium |
CVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-124429Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-124428Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/08/2026 | SeverityCritical |
|---|
CVE-2026-124426Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/08/2026 | SeverityMedium |
|---|
CVE-2026-123491Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-123490Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-123489Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/06/2026 | SeverityHigh |
|---|
CVE-2026-123488Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | Exploitation statusNot confirmed | FixYes | Affected productcms | Published11/06/2026 | SeverityCritical |
|---|
CVE-2026-115938Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/23/2026 | SeverityHigh |
|---|
CVE-2026-115937Unauthenticated payment reuse allows unpaid orders to be marked as paid | Exploitation statusNot exploited | FixYes | Affected productcommerce-mollie | Published10/23/2026 | SeverityHigh |
|---|
CVE-2026-115935Control panel only API response emulation replaces "securityKey" and reaches server RCE | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/23/2026 | SeverityHigh |
|---|
CVE-2026-112777Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112776Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityCritical |
|---|
CVE-2026-112775Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112774Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112773Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112772Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112771Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-112770Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/19/2026 | SeverityHigh |
|---|
CVE-2026-109308Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109307Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/12/2026 | SeverityLow |
|---|
CVE-2026-109306Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109305Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-109304Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-105985Authenticated RCE via render-components Entry Type overrides | Exploitation statusNot exploited | FixYes | Affected productcms | Published10/06/2026 | SeverityHigh |
|---|
CVE-2026-92594Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92593Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92592Craft CMS before 4.18.6 Remote Code Execution via signed cookie | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92591Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92590Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-92589Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/16/2026 | SeverityMedium |
|---|
CVE-2026-55795Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-79987Low-privilege RCE through element-search eager loading | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-86732Craft CMS before 5.10.12 Remote Code Execution via element-index | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/08/2026 | SeverityHigh |
|---|
CVE-2026-86731Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/08/2026 | SeverityHigh |
|---|
CVE-2026-86730Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/08/2026 | SeverityHigh |
|---|
CVE-2026-84802Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController | Exploitation statusActively exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84801Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84800Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84799Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84798Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84797Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84796Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84795Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityCritical |
|---|
CVE-2026-84794Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-84793Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name | Exploitation statusActively exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-84792Craft CMS before 5.10.11 Broken Access Control via element-indexes | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-79991Authenticated SQL Injection via nested eager-loading criteria | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityHigh |
|---|
174 Results | Page 1 of 4