craftcms
- Total products in the ecosystem
- 8
- Total vulnerabilities (90 days)
- 64
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, craftcms recorded 64 security vulnerabilities in the last 90 days across 3 products, including 48 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, cms had the most security vulnerabilities in the craftcms ecosystem, with 62 vulnerabilities—approximately 96.88% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-32265Amazon S3 for Craft CMS has an Information Disclosure vulnerabilityCVE-2026-32267Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()CVE-2026-32264Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllerCVE-2026-32263Craft CMS vulnerable to behavior injection RCE via EntryTypesControllerCVE-2026-32262Craft CMS has a Path Traversal Vulnerability in AssetsController| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-32265Amazon S3 for Craft CMS has an Information Disclosure vulnerability | Exploitation statusNot exploited | FixNo |
| Published03/18/2026 |
| SeverityMedium |
CVE-2026-32267Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() | Exploitation statusActively exploited | FixYes | Affected productcms | Published03/16/2026 | SeverityHigh |
|---|
CVE-2026-32264Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/16/2026 | SeverityHigh |
|---|
CVE-2026-32263Craft CMS vulnerable to behavior injection RCE via EntryTypesController | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/16/2026 | SeverityHigh |
|---|
CVE-2026-32262Craft CMS has a Path Traversal Vulnerability in AssetsController | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/16/2026 | SeverityMedium |
|---|
CVE-2026-32261RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin | Exploitation statusNot exploited | FixYes | Affected productwebhooks | Published03/16/2026 | SeverityHigh |
|---|
CVE-2026-31867Craft Commerce has a Potential IDOR in Commerce carts | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-31859Craft has Reflective XSS via incomplete return URL sanitization | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/11/2026 | SeverityMedium |
|---|
CVE-2026-31858CraftCMS's `ElementSearchController` Affected by Blind SQL Injection | Exploitation statusNot exploited | FixNo | Affected productcms | Published03/11/2026 | SeverityHigh |
|---|
CVE-2026-31857CraftCMS has an RCE vulnerability via relational conditionals in the control panel | Exploitation statusNot exploited | FixNo | Affected productcms | Published03/11/2026 | SeverityHigh |
|---|
CVE-2026-29177Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published03/10/2026 | SeverityLow |
|---|
CVE-2026-29176Craft Commerce has Stored XSS in Inventory Location Name | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published03/10/2026 | SeverityMedium |
|---|
CVE-2026-29175Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-29174Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-29173Craft Commerce has Stored XSS while updating Order Status from Orders Table | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published03/10/2026 | SeverityLow |
|---|
CVE-2026-29172Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published03/10/2026 | SeverityHigh |
|---|
CVE-2026-29113Craft has a potential information disclosure vulnerability in preview tokens | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/10/2026 | SeverityLow |
|---|
CVE-2026-29069Craft has an unauthenticated activation email trigger with potential user enumeration | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/04/2026 | SeverityMedium |
|---|
CVE-2026-28784Craft is affected by potential authenticated Remote Code Execution via Twig SSTI | Exploitation statusNot exploited | FixNo | Affected productcms | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-28783Craft has a Twig Function Blocklist Bypass | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/04/2026 | SeverityCritical |
|---|
CVE-2026-28782Craft has a Permission Bypass and IDOR in Duplicate Entry Action | Exploitation statusActively exploited | FixYes | Affected productcms | Published03/04/2026 | SeverityMedium |
|---|
CVE-2026-28781Craft Affected by Entries Authorship Spoofing via Mass Assignment | Exploitation statusActively exploited | FixYes | Affected productcms | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-28697Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates | Exploitation statusActively exploited | FixYes | Affected productcms | Published03/04/2026 | SeverityCritical |
|---|
CVE-2026-28696Craft affected by IDOR via GraphQL @parseRefs | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-28695Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | Exploitation statusNot exploited | FixYes | Affected productcms | Published03/04/2026 | SeverityHigh |
|---|
CVE-2026-27129Cloud Metadata SSRF Protection Bypass via IPv6 Resolution | Exploitation statusNot exploited | FixNo | Affected productcms | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-27128Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit | Exploitation statusNot exploited | FixNo | Affected productcms | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-27127Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding | Exploitation statusActively exploited | FixNo | Affected productcms | Published02/24/2026 | SeverityHigh |
|---|
CVE-2026-27126Craft CMS has Stored XSS in Table Field via "HTML" Column Type | Exploitation statusActively exploited | FixNo | Affected productcms | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-25498Craft has a potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityHigh |
|---|
CVE-2026-25497Craft has a GraphQL Asset Mutation Privilege Escalation | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityHigh |
|---|
CVE-2026-25496Craft has a stored XSS in Number Prefix & Suffix Fields | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25495Craft has a SQL Injection in Element Indexes via criteria[orderBy] | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityHigh |
|---|
CVE-2026-25494Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25493Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25492Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityMedium |
|---|
CVE-2026-25491Craft has a Stored XSS in Entry Types Name | Exploitation statusNot exploited | FixYes | Affected productcms | Published02/09/2026 | SeverityLow |
|---|
CVE-2026-25522Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25490Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25489Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25488Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25487Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25486Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation | Exploitation statusActively exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25485Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25484Craft Commerce has Stored XSS in Product Type Name | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25483Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-25482Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) | Exploitation statusNot exploited | FixYes | Affected productcommerce | Published02/03/2026 | SeverityMedium |
|---|
CVE-2020-37071CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution | Exploitation statusActively exploited | FixNo | Affected productCraftCMS | Published02/03/2026 | SeverityCritical |
|---|
CVE-2025-68456Unauthenticated Craft CMS users can trigger a database backup | Exploitation statusActively exploited | FixNo | Affected productcms | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | Exploitation statusActively exploited | FixNo | Affected productcms | Published01/05/2026 | SeverityHigh |
|---|
174 Results | Page 3 of 4