Known vulnerabilities in Craft CMS 5.10.9

Software: Craft CMS
Version: 5.10.9
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 19
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Craft CMS version 5.10.9 Craft CMS 5.10.9 is affected by 19 vulnerabilities: 1 high, 8 medium, 10 low Critical High Medium Low

Vulnerabilities (19)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146757 - Missing Authorization
CWE-862 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146747 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.10.13 02.09.2026 SB2026090260
#VU146746 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146745 - Not Failing Securely (\'Failing Open\')
CWE-636 Medium
No
No
5.10.13 02.09.2026 SB2026090260
#VU146743 - Improper Neutralization of Special Elements Used in a Template Engine
CWE-1336 Medium
No
No
4.18.6, 5.10.13 02.09.2026 SB2026090260
#VU146742 - Exposure of sensitive information to an unauthorized actor
CWE-200 Medium
No
No
5.11.0 02.09.2026 SB2026090259
#VU145007 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU145006 - Missing Authorization
CWE-862 Low
No
No
5.10.12 25.08.2026 SB2026081960
#VU145005 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
5.10.12 25.08.2026 SB2026081960
#VU144284 - Missing Authorization
CWE-862 Low
No
No
5.10.12 19.08.2026 SB2026081960
#VU144283 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144282 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144280 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144279 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144278 - Authorization Bypass Through User-Controlled Key
CWE-639 Medium
No
No
5.10.11 19.08.2026 SB2026081958
#VU144277 - Improper Privilege Management
CWE-269 High
No
No
5.10.11 19.08.2026 SB2026081958
#VU144276 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144275 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.10.11 19.08.2026 SB2026081958
#VU144274 - Missing Authorization
CWE-862 Low
No
No
5.10.11 19.08.2026 SB2026081958