Known vulnerabilities in Craft CMS 5.10.11

Software: Craft CMS
Version: 5.10.11
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 10
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Craft CMS version 5.10.11 Craft CMS 5.10.11 is affected by 10 vulnerabilities: 7 medium, 3 low Critical High Medium Low

Vulnerabilities (10)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146757 - Missing Authorization
CWE-862 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146747 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.10.13 02.09.2026 SB2026090260
#VU146746 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146745 - Not Failing Securely (\'Failing Open\')
CWE-636 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146743 - Improper Neutralization of Special Elements Used in a Template Engine
CWE-1336 Medium
No
No
4.18.6, 5.10.13 02.09.2026 SB2026090260
#VU146742 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
5.11.0 02.09.2026 SB2026090259
#VU145007 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU145006 - Missing Authorization
CWE-862 Low
No
No
5.10.12 25.08.2026 SB2026081960
#VU145005 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU144284 - Missing Authorization
CWE-862 Low
No
No
5.10.12 19.08.2026 SB2026081960