Known vulnerabilities in Craft CMS

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 142
Public exploits: 13
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 142 known vulnerabilities: 1 critical, 13 high, 54 medium, 74 low Critical High Medium Low

Vulnerabilities (142)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU139962 - Missing Authorization
CWE-862 Low
No
No
4.18.1, 5.10.3 29.07.2026 SB2026072921
#VU139961 - Missing Authorization
CWE-862 Low
No
No
4.18.1, 5.10.3 29.07.2026 SB2026072921
#VU134678 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-55794
CWE-94 Medium
No
No
5.10.0 16.06.2026 SB2026061672
#VU134677 - Improper Access Control
CVE-2026-55792
CWE-284 Low
No
No
4.18.0, 5.10.0 16.06.2026 SB2026061672
#VU134675 - Server-Side Request Forgery (SSRF)
CVE-2026-55791
CWE-918 Medium
No
No
4.18.0, 5.10.0 16.06.2026 SB2026061672
#VU134676 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
4.18.0, 5.10.0 16.06.2026 SB2026061672
#VU134674 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-55793
CWE-79 Low
No
No
5.10.0 16.06.2026 SB2026061672
#VU134673 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-55790
CWE-79 Medium
No
No
4.17.16, 5.9.23 16.06.2026 SB2026061671
#VU134672 - Missing Authorization
CVE-2026-44012
CWE-862 Low
No
No
5.9.18 16.06.2026 SB2026061670
#VU134671 - Missing Authorization
CVE-2026-44010
CWE-862 Low
No
No
4.17.12, 5.9.18 16.06.2026 SB2026061670
#VU134670 - Improper input validation
CVE-2026-44011
CWE-20 Medium
No
No
4.17.12, 5.9.18 16.06.2026 SB2026061670
#VU134669 - Improper input validation
CVE-2026-41130
CWE-20 Medium
No
No
4.17.9, 5.9.15 16.06.2026 SB2026061669
#VU134668 - Server-Side Request Forgery (SSRF)
CVE-2026-41129
CWE-918 Low
No
No
4.17.9, 5.9.15 16.06.2026 SB2026061669
#VU134667 - Missing Authorization
CVE-2026-41128
CWE-862 Low
No
No
5.9.15 16.06.2026 SB2026061669
#VU134666 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-32263
CWE-94 Low
No
No
5.9.11 16.06.2026 SB2026061668
#VU134665 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-32264
CWE-94 Low
No
No
4.17.5, 5.9.11 16.06.2026 SB2026061668
#VU134664 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-33051
CWE-79 Low
No
No
5.9.11 16.06.2026 SB2026061668
#VU134663 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-32262
CWE-22 Low
No
No
4.17.5, 5.9.11 16.06.2026 SB2026061668
#VU134662 - Improper Access Control
CVE-2026-32267
CWE-284 High
No
No
4.17.6, 5.9.12 16.06.2026 SB2026061667
#VU134658 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-31858
CWE-89 Low
No
No
5.9.9 16.06.2026 SB2026061666


Showing elements 1 - 20 out of 142