Known vulnerabilities in October CMS

Vendor: OctoberCMS
Software: October CMS
Software CPE: cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*
Total vulnerabilities: 53
Public exploits: 5
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting October CMS October CMS is affected by 53 known vulnerabilities: 5 high, 15 medium, 33 low Critical High Medium Low

Vulnerabilities (53)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU149493 - Improper Privilege Management
CVE-2026-46696
CWE-269 Low
No
No
3.7.17, 4.2.23 14.09.2026 SB2026091425
#VU149492 - Deserialization of Untrusted Data
CVE-2026-49400
CWE-502 Low
No
No
3.7.17, 4.2.21 14.09.2026 SB2026091425
#VU149491 - Improper Access Control
CWE-284 Low
No
No
3.7.17, 4.2.21 14.09.2026 SB2026091425
#VU149490 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
3.7.17, 4.2.23 14.09.2026 SB2026091425
#VU149489 - Improper input validation
CWE-20 Low
No
No
4.3.5 14.09.2026 SB2026091424
#VU149488 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
4.3.5 14.09.2026 SB2026091424
#VU126643 - Improper Access Control
CVE-2026-26067
CWE-284 Low
No
No
3.7.14, 4.1.10 21.04.2026 SB2026041437
#VU126642 - Improper Access Control
CVE-2026-26274
CWE-284 Low
No
No
3.7.14, 4.1.10 21.04.2026 SB2026041437
#VU126641 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-27937
CWE-79 Medium
No
No
3.7.16, 4.1.16 21.04.2026 SB2026042130
#VU126640 - Improper Access Control
CVE-2026-29179
CWE-284 Low
No
No
3.7.16, 4.1.16 21.04.2026 SB2026042130
#VU125892 - Improper Access Control
CVE-2026-22692
CWE-284 Low
No
No
3.7.13, 4.1.5 14.04.2026 SB2026041436
#VU125891 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24907
CWE-79 Low
No
No
4.1.10 14.04.2026 SB2026041437
#VU125890 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-24906
CWE-79 Low
No
No
4.1.10 14.04.2026 SB2026041437
#VU125889 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-25125
CWE-74 Low
No
No
4.1.10 14.04.2026 SB2026041437
#VU125888 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-25133
CWE-79 Low
No
No
4.1.10 14.04.2026 SB2026041437
#VU125887 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-61674
CWE-79 Low
No
No
3.7.13, 4.0.12 14.04.2026 SB2026041436
#VU125886 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-61676
CWE-79 Low
No
No
3.7.13, 4.0.12 14.04.2026 SB2026041436
#VU125885 - Improper Access Control
CVE-2024-51991
CWE-284 Low
No
No
3.7.5 14.04.2026 SB2026041435
#VU93481 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-25637
CWE-79 Low
No
No
3.5.15 28.06.2024 SB2024062819
#VU93480 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2024-24764
CWE-601 Low
No
No
3.5.15 28.06.2024 SB2024062819


Showing elements 1 - 20 out of 53