- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, cms recorded 56 security vulnerabilities in the last 90 days, of which 43 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of cms and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-29113Craft has a potential information disclosure vulnerability in preview tokensCVE-2026-29069Craft has an unauthenticated activation email trigger with potential user enumerationCVE-2026-28784Craft is affected by potential authenticated Remote Code Execution via Twig SSTICVE-2026-28783Craft has a Twig Function Blocklist BypassCVE-2026-28782Craft has a Permission Bypass and IDOR in Duplicate Entry Action| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-29113Craft has a potential information disclosure vulnerability in preview tokens | Exploitation statusNot exploited | FixYes |
| SeverityLow |
CVE-2026-29069Craft has an unauthenticated activation email trigger with potential user enumeration | Exploitation statusNot exploited | FixYes | Published03/04/2026 | SeverityMedium |
|---|
CVE-2026-28784Craft is affected by potential authenticated Remote Code Execution via Twig SSTI | Exploitation statusNot exploited | FixNo | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-28783Craft has a Twig Function Blocklist Bypass | Exploitation statusNot exploited | FixYes | Published03/04/2026 | SeverityCritical |
|---|
CVE-2026-28782Craft has a Permission Bypass and IDOR in Duplicate Entry Action | Exploitation statusActively exploited | FixYes | Published03/04/2026 | SeverityMedium |
|---|
CVE-2026-28781Craft Affected by Entries Authorship Spoofing via Mass Assignment | Exploitation statusActively exploited | FixYes | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-28697Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates | Exploitation statusActively exploited | FixYes | Published03/04/2026 | SeverityCritical |
|---|
CVE-2026-28696Craft affected by IDOR via GraphQL @parseRefs | Exploitation statusNot exploited | FixYes | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-28695Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | Exploitation statusNot exploited | FixYes | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-27129Cloud Metadata SSRF Protection Bypass via IPv6 Resolution | Exploitation statusNot exploited | FixNo | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-27128Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit | Exploitation statusNot exploited | FixNo | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-27127Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding | Exploitation statusActively exploited | FixNo | Published02/24/2026 | SeverityHigh |
|---|
CVE-2026-27126Craft CMS has Stored XSS in Table Field via "HTML" Column Type | Exploitation statusActively exploited | FixNo | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-25498Craft has a potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityHigh |
|---|
CVE-2026-25497Craft has a GraphQL Asset Mutation Privilege Escalation | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityHigh |
|---|
CVE-2026-25496Craft has a stored XSS in Number Prefix & Suffix Fields | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25495Craft has a SQL Injection in Element Indexes via criteria[orderBy] | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityHigh |
|---|
CVE-2026-25494Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25493Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25492Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25491Craft has a Stored XSS in Entry Types Name | Exploitation statusNot exploited | FixYes | Published02/09/2026 | SeverityLow |
|---|
CVE-2025-68456Unauthenticated Craft CMS users can trigger a database backup | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-68454Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI | Exploitation statusNot exploited | FixNo | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-68437Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-68436Craft CMS vulnerable to potential information disclosure via unchecked asset relocation | Exploitation statusNot exploited | FixNo | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-57811Craft Potential Remote Code Execution via Twig SSTI | Exploitation statusNot exploited | FixYes | Published08/25/2025 | SeverityMedium |
|---|
CVE-2025-54417Craft contains a theoretical bypass for CVE-2025-23209 | Exploitation statusNot exploited | FixYes | Published08/09/2025 | SeverityMedium |
|---|
CVE-2025-46731Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI | Exploitation statusActively exploited | FixNo | Published05/05/2025 | SeverityHigh |
|---|
CVE-2025-32432Craft CMS Allows Remote Code Execution | Exploitation statusKEV | FixYes | Published04/25/2025 | SeverityCritical |
|---|
CVE-2025-23209Potential RCE with a compromised security key in craft/cms | Exploitation statusKEV | FixYes | Published01/18/2025 | SeverityHigh |
|---|
CVE-2024-56145RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms | Exploitation statusKEV | FixNo | Published12/18/2024 | SeverityCritical |
|---|
CVE-2024-52293Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI | Exploitation statusActively exploited | FixYes | Published11/13/2024 | SeverityHigh |
|---|
CVE-2024-52292Craft Allows Attackers to Read Arbitrary System Files | Exploitation statusActively exploited | FixYes | Published11/13/2024 | SeverityHigh |
|---|
CVE-2024-52291Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution | Exploitation statusActively exploited | FixYes | Published11/13/2024 | SeverityHigh |
|---|
CVE-2024-45406Craft CMS stored XSS in breadcrumb list and title fields | Exploitation statusActively exploited | FixNo | Published09/09/2024 | SeverityMedium |
|---|
CVE-2024-41800Craft CMS Allows TOTP Token To Stay Valid After Use | Exploitation statusActively exploited | FixYes | Published07/25/2024 | SeverityMedium |
|---|
CVE-2024-21622Craft CMS Privilege Escalation | Exploitation statusNot exploited | FixYes | Published01/03/2024 | SeverityMedium |
|---|
CVE-2023-41892Craft CMS Remote Code Execution vulnerability | Exploitation statusNot confirmed | FixYes | Published09/13/2023 | SeverityCritical |
|---|
CVE-2023-40035Craft CMS vulnerable to Remote Code Execution via validatePath bypass | Exploitation statusActively exploited | FixYes | Published08/23/2023 | SeverityHigh |
|---|
CVE-2023-33195Craft CMS XSS in RSS widget feed | Exploitation statusNot exploited | FixYes | Published05/27/2023 | SeverityMedium |
|---|
CVE-2023-33197Craft CMS stored XSS in indexedVolumes | Exploitation statusActively exploited | FixYes | Published05/26/2023 | SeverityMedium |
|---|
CVE-2023-33196Craft CMS stored XSS in review volume | Exploitation statusActively exploited | FixYes | Published05/26/2023 | SeverityMedium |
|---|
CVE-2023-33194CraftCMS stored XSS in Quick Post widget error message | Exploitation statusActively exploited | FixYes | Published05/26/2023 | SeverityLow |
|---|
CVE-2023-32679Remote Code Execution via unrestricted file extension in Craft CMS | Exploitation statusActively exploited | FixNo | Published05/19/2023 | SeverityHigh |
|---|
CVE-2023-31144Craft CMS vulnerable to cross site scripting in RSS feed widget | Exploitation statusNot exploited | FixYes | Published05/09/2023 | SeverityMedium |
|---|
CVE-2023-23927Craft CMS stored cross-site scripting vulnerability | Exploitation statusNot exploited | FixYes | Published03/03/2023 | SeverityMedium |
|---|
141 Results | Page 3 of 3