Known vulnerabilities in Pimcore

Vendor: Pimcore
Software: Pimcore
Software CPE: cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
Total vulnerabilities: 95
Public exploits: 8
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Pimcore Pimcore is affected by 95 known vulnerabilities: 10 high, 34 medium, 51 low Critical High Medium Low

Vulnerabilities (95)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150532 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-55416
CWE-89 Medium
No
No
12.3.10, 2026.1.6 17.09.2026 SB20260917214
#VU150531 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-55634
CWE-94 Medium
No
No
12.3.10, 2026.1.6 17.09.2026 SB20260917214
#VU150529 - Deserialization of Untrusted Data
CVE-2026-55220
CWE-502 Low
No
No
12.3.10, 2026.1.6 17.09.2026 SB20260917214
#VU134523 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-55072
CWE-89 Medium
No
No
11.5.18, 12.3.9, 2026.1.5 15.06.2026 SB2026061537
#VU134522 - Improper Access Control
CVE-2026-45704
CWE-284 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134521 - Improper Access Control
CVE-2026-45703
CWE-284 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134519 - Deserialization of Untrusted Data
CVE-2026-45162
CWE-502 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134518 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-44739
CWE-89 Medium
No
No
11.5.17 15.06.2026 SB2026061535
#VU134517 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-5394
CWE-89 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134516 - Missing Authorization
CVE-2026-45260
CWE-862 Medium
No
No
11.5.17 15.06.2026 SB2026061535
#VU127507 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-23492
CWE-89 Medium
Available
No
11.5.14, 12.3.1 24.04.2026 SB2026042488
#VU123173 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27461
CWE-89 Low
No
No
11.5.15, 12.3.3 24.02.2026 SB2026022441
#VU121622 - Improper Access Control
CVE-2026-23494
CWE-284 Medium
No
No
11.5.14, 12.3.1 16.01.2026 SB20260116107
#VU96732 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-45048
CWE-611 Medium
No
No
10.6.9.12, 11.1.6.11 03.09.2024 SB2024090360
SB20241230139
SB2024090385
#VU134515 - Improper Access Control
CVE-2024-29197
CWE-284 Medium
No
No
11.1.6, 11.2.2 26.03.2024 SB2024032658
#VU134421 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-47637
CWE-89 Medium
No
No
11.1.1 15.11.2023 SB2023111553
#VU134426 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-31092
CWE-89 Medium
No
No
10.4.4 22.06.2022 SB2022062259
#VU134425 - Observable Response Discrepancy
CVE-2021-39189
CWE-204 Medium
No
No
10.1.3 15.09.2021 SB2021091550
#VU134424 - Improper Neutralization of Formula Elements in a CSV File
CVE-2021-37702
CWE-1236 Low
No
No
10.1.1 18.08.2021 SB2021081848
#VU134422 - Improper Access Control
CVE-2020-26246
CWE-284 Low
No
No
6.8.5 30.11.2020 SB2020113030


Showing elements 1 - 20 out of 95