Known vulnerabilities in Craft CMS - page 2

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 137
Public exploits: 13
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 137 known vulnerabilities: 1 critical, 13 high, 50 medium, 73 low Critical High Medium Low

Vulnerabilities (137)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU139972 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
5.10.8 29.07.2026 SB2026072925
#VU139971 - Improper Authorization
CWE-285 Low
No
No
5.10.8 29.07.2026 SB2026072925
#VU139970 - Incorrect Authorization
CWE-863 Low
No
No
5.10.6 29.07.2026 SB2026072922
#VU139969 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139968 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139967 - Exposure of resource to wrong sphere
CWE-668 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139966 - Protection Mechanism Failure
CWE-693 Medium
No
No
4.18.3, 5.10.7 29.07.2026 SB2026072924
#VU139965 - Authentication Bypass by Capture-replay
CWE-294 High
No
No
5.10.5 29.07.2026 SB2026072923
#VU139964 - Incomplete List of Disallowed Inputs
CWE-184 Low
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139963 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-915 Medium
No
No
4.18.2, 5.10.6 29.07.2026 SB2026072922
#VU139962 - Missing Authorization
CWE-862 Low
No
No
4.18.1, 5.10.3 29.07.2026 SB2026072921
#VU139961 - Missing Authorization
CWE-862 Low
No
No
4.18.1, 5.10.3 29.07.2026 SB2026072921
#VU134678 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-55794
CWE-94 Medium
No
No
5.10.0 16.06.2026 SB2026061672
#VU134677 - Improper Access Control
CVE-2026-55792
CWE-284 Low
No
No
4.18.0, 5.10.0 16.06.2026 SB2026061672
#VU134675 - Server-Side Request Forgery (SSRF)
CVE-2026-55791
CWE-918 Medium
No
No
4.18.0, 5.10.0 16.06.2026 SB2026061672
#VU134676 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
4.18.0, 5.10.0 16.06.2026 SB2026061672
#VU134674 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-55793
CWE-79 Low
No
No
5.10.0 16.06.2026 SB2026061672
#VU134673 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-55790
CWE-79 Medium
No
No
4.17.16, 5.9.23 16.06.2026 SB2026061671
#VU134671 - Missing Authorization
CVE-2026-44010
CWE-862 Low
No
No
4.17.12, 5.9.18 16.06.2026 SB2026061670
#VU134670 - Improper input validation
CVE-2026-44011
CWE-20 Medium
No
No
4.17.12, 5.9.18 16.06.2026 SB2026061670


Showing elements 21 - 40 out of 137