- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, cms recorded 56 security vulnerabilities in the last 90 days, of which 43 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of cms and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-79988Authenticated RCE through Twig sandbox escapeCVE-2026-78416Authenticated RCE via `condition.config` JSON cleanse bypassCVE-2026-72787Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameCVE-2026-72786Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password ResetCVE-2026-72785Craft CMS before 5.10.6 Authorization Bypass via structures/move-element| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-79988Authenticated RCE through Twig sandbox escape | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-78416Authenticated RCE via `condition.config` JSON cleanse bypass | Exploitation statusNot exploited | FixYes | Published08/24/2026 | SeverityHigh |
|---|
CVE-2026-72787Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-72786Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-72785Craft CMS before 5.10.6 Authorization Bypass via structures/move-element | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityCritical |
|---|
CVE-2026-72784Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityMedium |
|---|
CVE-2026-72783Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityMedium |
|---|
CVE-2026-72782Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72781Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72780Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72779Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72778Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config | Exploitation statusNot exploited | FixYes | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-50282Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves | Exploitation statusNot exploited | FixYes | Published07/02/2026 | SeverityMedium |
|---|
CVE-2026-50281Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements | Exploitation statusNot exploited | FixYes | Published07/02/2026 | SeverityHigh |
|---|
CVE-2026-55794Craft CMS: Potential authenticated Remote Code Execution via referrer redirect | Exploitation statusNot exploited | FixYes | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-55793Craft CMS: Stored XSS via Structure entry title in table view | Exploitation statusActively exploited | FixYes | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-55792Craft CMS: Sensitive File Disclosure / Server-Side File Read | Exploitation statusActively exploited | FixYes | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-55791Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs | Exploitation statusNot exploited | FixYes | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-55790Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget | Exploitation statusNot exploited | FixYes | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-50284Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets | Exploitation statusNot exploited | FixYes | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-50283Craft CMS: Unauthorized Deletion of Source Assets During File Replacement | Exploitation statusNot exploited | FixYes | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-50280Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check | Exploitation statusNot exploited | FixYes | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-50279Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap | Exploitation statusActively exploited | FixYes | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-56394Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | Exploitation statusNot exploited | FixYes | Published06/21/2026 | SeverityHigh |
|---|
CVE-2026-56393Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | Exploitation statusActively exploited | FixYes | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56385Craft CMS - Authorization Bypass in assets/preview-file Endpoint | Exploitation statusNot exploited | FixYes | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56384Craft CMS - Missing Authorization in assets/preview-thumb Endpoint | Exploitation statusNot exploited | FixYes | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56383Craft CMS - Stored XSS in Table Field via Row Heading Column Type | Exploitation statusActively exploited | FixYes | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56382Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController | Exploitation statusActively exploited | FixYes | Published06/21/2026 | SeverityHigh |
|---|
CVE-2026-56381Craft CMS - Stored XSS via User Group Name in User Permissions Page | Exploitation statusActively exploited | FixYes | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-44012Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-44011Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusActively exploited | FixYes | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-44010Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | Exploitation statusActively exploited | FixYes | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-41130Craft CMS has a host header injection leading to SSRF via resource-js endpoint | Exploitation statusActively exploited | FixNo | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-41129Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations | Exploitation statusNot exploited | FixNo | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-41128Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action | Exploitation statusNot exploited | FixNo | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-33162Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33161Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityLow |
|---|
CVE-2026-33160Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityLow |
|---|
CVE-2026-33159Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users | Exploitation statusActively exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33158Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33157Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusNot exploited | FixYes | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33051Craft CMS Vulnerable to Stored XSS in Revision Context Menu | Exploitation statusNot exploited | FixYes | Published03/20/2026 | SeverityMedium |
|---|
CVE-2026-32267Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() | Exploitation statusActively exploited | FixYes | Published03/16/2026 | SeverityHigh |
|---|
CVE-2026-32264Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController | Exploitation statusNot exploited | FixYes | Published03/16/2026 | SeverityHigh |
|---|
CVE-2026-32263Craft CMS vulnerable to behavior injection RCE via EntryTypesController | Exploitation statusNot exploited | FixYes | Published03/16/2026 | SeverityHigh |
|---|
CVE-2026-32262Craft CMS has a Path Traversal Vulnerability in AssetsController | Exploitation statusNot exploited | FixYes | Published03/16/2026 | SeverityMedium |
|---|
CVE-2026-31859Craft has Reflective XSS via incomplete return URL sanitization | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-31858CraftCMS's `ElementSearchController` Affected by Blind SQL Injection | Exploitation statusNot exploited | FixNo | Published03/11/2026 | SeverityHigh |
|---|
CVE-2026-31857CraftCMS has an RCE vulnerability via relational conditionals in the control panel | Exploitation statusNot exploited | FixNo | Published03/11/2026 | SeverityHigh |
|---|
141 Results | Page 2 of 3