Known vulnerabilities in Craft CMS - page 2

Software: Craft CMS
Software CPE: cpe:2.3:a:pixel_and_tonic:craft_cms:*:*:*:*:*:*:*:*
Total vulnerabilities: 142
Public exploits: 13
Known exploited (KEV): 4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Craft CMS Craft CMS is affected by 142 known vulnerabilities: 1 critical, 13 high, 54 medium, 74 low Critical High Medium Low

Vulnerabilities (142)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134661 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-31859
CWE-79 Medium
No
No
4.17.3, 5.9.7 16.06.2026 SB2026061666
#VU134660 - Cross-Site Request Forgery (CSRF)
CVE-2026-29113
CWE-352 Low
No
No
4.17.4, 5.9.7 16.06.2026 SB2026061666
#VU134659 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-31857
CWE-94 Medium
No
No
4.17.4, 5.9.9 16.06.2026 SB2026061666
#VU132954 - Missing Authorization
CVE-2026-50284
CWE-862 Medium
No
No
4.17.15, 5.9.22 29.05.2026 SB2026052953
#VU132935 - Improper Authorization
CVE-2026-50283
CWE-285 Medium
No
No
4.17.14, 5.9.21 29.05.2026 SB2026052955
#VU132934 - Improper Authorization
CVE-2026-50282
CWE-285 Medium
No
No
4.17.14, 5.9.21 29.05.2026 SB2026052955
#VU132781 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-50281
CWE-915 Medium
No
No
5.9.21 29.05.2026 SB2026052955
#VU132779 - Improper Access Control
CVE-2026-50280
CWE-284 Medium
No
No
5.9.21 29.05.2026 SB2026052955
#VU132778 - Improper Authorization
CVE-2026-50279
CWE-285 Medium
No
No
5.9.21 29.05.2026 SB2026052955
#VU126476 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2025-57811
CWE-1336 Low
No
No
4.16.6, 5.8.7 17.04.2026 SB20260417105
#VU126475 - Improper Access Control
CVE-2025-54417
CWE-284 Low
No
No
4.16.3, 5.8.4 17.04.2026 SB20260417104
#VU124282 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2026-33157
CWE-470 Medium
No
No
5.9.13 24.03.2026 SB2026032461
#VU123018 - Server-Side Request Forgery (SSRF)
CVE-2026-25493
CWE-918 Medium
Available
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123017 - Server-Side Request Forgery (SSRF)
CVE-2026-25494
CWE-918 Medium
Available
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU123012 - Server-Side Request Forgery (SSRF)
CVE-2026-25492
CWE-918 Low
Available
No
4.16.18, 5.8.22 18.02.2026 SB2026021833
#VU126473 - Improper input validation
CVE-2024-52291
CWE-20 Low
No
No
4.12.5, 5.4.6 13.11.2024 SB2024111363
#VU126474 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-52293
CWE-22 Low
No
No
4.12.2, 5.4.3 13.11.2024 SB2024111362
#VU134650 - Files or Directories Accessible to External Parties
CVE-2024-52292
CWE-552 Low
No
No
4.12.8, 5.4.9 13.11.2024 SB2024111364
#VU126471 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-31144
CWE-79 Medium
No
No
3.8.4, 4.4.4 05.05.2023 SB2023050534
#VU126470 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-28378
CWE-79 Medium
No
No
3.7.29 04.04.2022 SB2022040438


Showing elements 21 - 40 out of 142