Known vulnerabilities in Craft CMS

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 137
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 137 known vulnerabilities: 1 critical, 13 high, 50 medium, 73 low Critical High Medium Low

Vulnerabilities (137)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146757 - Missing Authorization
CWE-862 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146747 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.10.13 02.09.2026 SB2026090260
#VU146746 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146745 - Not Failing Securely (\'Failing Open\')
CWE-636 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146743 - Improper Neutralization of Special Elements Used in a Template Engine
CWE-1336 Medium
No
No
4.18.6, 5.10.13 02.09.2026 SB2026090260
#VU146742 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
5.11.0 02.09.2026 SB2026090259
#VU145007 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU145006 - Missing Authorization
CWE-862 Low
No
No
5.10.12 25.08.2026 SB2026081960
#VU145005 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU144284 - Missing Authorization
CWE-862 Low
No
No
5.10.12 19.08.2026 SB2026081960
#VU144283 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144282 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144281 - Improper Authorization
CWE-285 Low
No
No
99.99.1 19.08.2026 SB2026081959
#VU144280 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144279 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144278 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
No
No
5.10.11 19.08.2026 SB2026081958
#VU144277 - Improper Privilege Management
CWE-269 High
No
No
5.10.11 19.08.2026 SB2026081958
#VU144276 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144275 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144274 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958


Showing elements 1 - 20 out of 137