craftcms
- Total products in the ecosystem
- 8
- Total vulnerabilities (90 days)
- 64
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, craftcms recorded 64 security vulnerabilities in the last 90 days across 3 products, including 48 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, cms had the most security vulnerabilities in the craftcms ecosystem, with 62 vulnerabilities—approximately 96.88% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-79990GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/deleteCVE-2026-79989Arbitrary user password reset leading to administrator account takeoverCVE-2026-79988Authenticated RCE through Twig sandbox escapeCVE-2026-78416Authenticated RCE via `condition.config` JSON cleanse bypassCVE-2026-72787Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-79990GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete | Exploitation statusNot exploited | FixYes |
| Affected productcms |
| Published09/02/2026 |
| SeverityHigh |
CVE-2026-79989Arbitrary user password reset leading to administrator account takeover | Exploitation statusNot exploited | FixYes | Affected productcms | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-79988Authenticated RCE through Twig sandbox escape | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/27/2026 | SeverityHigh |
|---|
CVE-2026-78416Authenticated RCE via `condition.config` JSON cleanse bypass | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/24/2026 | SeverityHigh |
|---|
CVE-2026-72787Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-72786Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-72785Craft CMS before 5.10.6 Authorization Bypass via structures/move-element | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityCritical |
|---|
CVE-2026-72784Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityMedium |
|---|
CVE-2026-72783Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityMedium |
|---|
CVE-2026-72782Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72781Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72780Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72779Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-72778Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config | Exploitation statusNot exploited | FixYes | Affected productcms | Published08/11/2026 | SeverityHigh |
|---|
CVE-2026-50282Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/02/2026 | SeverityMedium |
|---|
CVE-2026-50281Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/02/2026 | SeverityHigh |
|---|
CVE-2026-55794Craft CMS: Potential authenticated Remote Code Execution via referrer redirect | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-55793Craft CMS: Stored XSS via Structure entry title in table view | Exploitation statusActively exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-55792Craft CMS: Sensitive File Disclosure / Server-Side File Read | Exploitation statusActively exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-55791Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-55790Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-50284Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-50283Craft CMS: Unauthorized Deletion of Source Assets During File Replacement | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-50280Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check | Exploitation statusNot exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-50279Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap | Exploitation statusActively exploited | FixYes | Affected productcms | Published07/01/2026 | SeverityHigh |
|---|
CVE-2026-56394Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | Exploitation statusNot exploited | FixYes | Affected productcms | Published06/21/2026 | SeverityHigh |
|---|
CVE-2026-56393Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | Exploitation statusActively exploited | FixYes | Affected productcms | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56385Craft CMS - Authorization Bypass in assets/preview-file Endpoint | Exploitation statusNot exploited | FixYes | Affected productcms | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56384Craft CMS - Missing Authorization in assets/preview-thumb Endpoint | Exploitation statusNot exploited | FixYes | Affected productcms | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56383Craft CMS - Stored XSS in Table Field via Row Heading Column Type | Exploitation statusActively exploited | FixYes | Affected productcms | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-56382Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController | Exploitation statusActively exploited | FixYes | Affected productcms | Published06/21/2026 | SeverityHigh |
|---|
CVE-2026-56381Craft CMS - Stored XSS via User Group Name in User Permissions Page | Exploitation statusActively exploited | FixYes | Affected productcms | Published06/21/2026 | SeverityMedium |
|---|
CVE-2026-44012Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure | Exploitation statusNot exploited | FixYes | Affected productcms | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-44011Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusActively exploited | FixYes | Affected productcms | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-44010Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure | Exploitation statusActively exploited | FixYes | Affected productcms | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-41130Craft CMS has a host header injection leading to SSRF via resource-js endpoint | Exploitation statusActively exploited | FixNo | Affected productcms | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-41129Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations | Exploitation statusNot exploited | FixNo | Affected productcms | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-41128Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action | Exploitation statusNot exploited | FixNo | Affected productcms | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-32272Craft Commerce: Blind SQL Injection via hasVariant/hasProduct | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published04/13/2026 | SeverityHigh |
|---|
CVE-2026-32271Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published04/13/2026 | SeverityHigh |
|---|
CVE-2026-32270Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published04/13/2026 | SeverityLow |
|---|
CVE-2026-33162Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33161Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/24/2026 | SeverityLow |
|---|
CVE-2026-33160Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/24/2026 | SeverityLow |
|---|
CVE-2026-33159Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users | Exploitation statusActively exploited | FixYes | Affected productcms | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33158Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-33157Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/24/2026 | SeverityHigh |
|---|
CVE-2026-33051Craft CMS Vulnerable to Stored XSS in Revision Context Menu | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/20/2026 | SeverityMedium |
|---|
CVE-2026-32268Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability | Exploitation statusNot exploited | FixNo | Affected productazure-blob | Published03/18/2026 | SeverityHigh |
|---|
CVE-2026-32266Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability | Exploitation statusNot exploited | FixNo | Affected productgoogle-cloud | Published03/18/2026 | SeverityLow |
|---|
174 Results | Page 2 of 4